CVE-2026-43043

crypto: af-alg - fix NULL pointer dereference in scatterwalk

State: Published
Severity: Not scored
Published: May 1, 2026
Updated: May 11, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: af-alg - fix NULL pointer dereference in scatterwalk

The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent sendmsg() allocates a new SGL and chains it, but fails to clear the end marker on the previous SGL's last data entry.

This causes the crypto scatterwalk to hit a premature end, returning NULL on sg_next() and leading to a kernel panic during dereference.

Fix this by explicitly unmarking the end of the previous SGL when performing sg_chain() in af_alg_alloc_tsgl().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before f48d3dd99199180cf37d6253550c55e86372309aAffected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before f9acceae7b004956851fd4268edf9f518a9bce04Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 7195350fb78538c25cd790d703f8f2c73ee0d395Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 44eafa39363e8d5dfda6a8c6eb6b45458ed4b948Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 00cbdec17c15d024a1c5002c7365df7624a18a75Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 4b03ab0a587ec57eb7ddb5c115d84a42896f60f7Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 62397b493e14107ae82d8b80938f293d95425bcbAffected
LinuxLinux	2.6.38Affected before 2.6.38Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before f48d3dd99199180cf37d6253550c55e86372309aAffected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before f9acceae7b004956851fd4268edf9f518a9bce04Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 7195350fb78538c25cd790d703f8f2c73ee0d395Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 44eafa39363e8d5dfda6a8c6eb6b45458ed4b948Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 00cbdec17c15d024a1c5002c7365df7624a18a75Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 4b03ab0a587ec57eb7ddb5c115d84a42896f60f7Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 62397b493e14107ae82d8b80938f293d95425bcbAffected

LinuxLinux

2.6.38Affected
before 2.6.38Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.