CVE-2026-23060

crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec

State: Published
Severity: Not scored
Published: Feb 4, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec

authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_authenc_esn_decrypt() can advance past the end of the destination scatterlist and trigger a NULL pointer dereference in scatterwalk_map_and_copy(), leading to a kernel panic (DoS).

Add a minimum AAD length check to fail fast on invalid inputs.

Scores

The record has no CVSS score.

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	104880a6b470958ddc30e139c41aa4f6ed3a5234 to before df22c9a65e9a9daa368a72fed596af9d7d5876bbAffected 104880a6b470958ddc30e139c41aa4f6ed3a5234 to before fee86edf5803f1d1f19e3b4f2dacac241bddfa48Affected 104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 767e8349f7e929b7dd95c08f0b4cb353459b365eAffected 104880a6b470958ddc30e139c41aa4f6ed3a5234 to before b0a9609283a5c852addb513dafa655c61eebc1efAffected 104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 161bdc90fce25bd9890adc67fa1c8563a7acbf40Affected 104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 9532ff0d0e90ff78a214299f594ab9bac81defe4Affected 104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 2397e9264676be7794f8f7f1e9763d90bd3c7335Affected
LinuxLinux	4.3Affected before 4.3Not affected 5.10.249 through 5.10.Not affected 5.15.199 through 5.15.Not affected 6.1.162 through 6.1.Not affected 6.6.122 through 6.6.Not affected 6.12.68 through 6.12.Not affected 6.18.8 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

104880a6b470958ddc30e139c41aa4f6ed3a5234 to before df22c9a65e9a9daa368a72fed596af9d7d5876bbAffected
104880a6b470958ddc30e139c41aa4f6ed3a5234 to before fee86edf5803f1d1f19e3b4f2dacac241bddfa48Affected
104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 767e8349f7e929b7dd95c08f0b4cb353459b365eAffected
104880a6b470958ddc30e139c41aa4f6ed3a5234 to before b0a9609283a5c852addb513dafa655c61eebc1efAffected
104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 161bdc90fce25bd9890adc67fa1c8563a7acbf40Affected
104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 9532ff0d0e90ff78a214299f594ab9bac81defe4Affected
104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 2397e9264676be7794f8f7f1e9763d90bd3c7335Affected

LinuxLinux

4.3Affected
before 4.3Not affected
5.10.249 through 5.10.*Not affected
5.15.199 through 5.15.*Not affected
6.1.162 through 6.1.*Not affected
6.6.122 through 6.6.*Not affected
6.12.68 through 6.12.*Not affected
6.18.8 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.