https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 14:56:51 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80843 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfrm: fix xfrm_state_construct() auth-trunc leak</p> <p>attach_auth_trunc() can allocate x-&gt;aalg while leaving x-&gt;props.aalgo at zero when the selected auth algorithm has no sadb_alg_id. One real case is cmac(aes).</p> <p>xfrm_state_construct() then treats !x-&gt;props.aalgo as &#34;no auth algorithm attached yet&#34; and calls attach_auth(). That overwrites x-&gt;aalg and loses the first allocation. Any later failure or teardown only frees the replacement pointer.</p> <p>Check whether x-&gt;aalg is already attached instead of inferring that state from x-&gt;props.aalgo.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfrm: fix xfrm_state_construct() auth-trunc leak</p> <p>attach_auth_trunc() can allocate x-&gt;aalg while leaving x-&gt;props.aalgo at zero when the selected auth algorithm has no sadb_alg_id. One real case is cmac(aes).</p> <p>xfrm_state_construct() then treats !x-&gt;props.aalgo as &#34;no auth algorithm attached yet&#34; and calls attach_auth(). That overwrites x-&gt;aalg and loses the first allocation. Any later failure or teardown only frees the replacement pointer.</p> <p>Check whether x-&gt;aalg is already attached instead of inferring that state from x-&gt;props.aalgo.</p> https://vulnerability.circl.lu/vuln/cve-2026-80843