CVE-2026-43077

crypto: algif_aead - Fix minimum RX size check for decryption

State: Published
Severity: Not scored
Published: May 6, 2026
Updated: May 11, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Fix minimum RX size check for decryption

The check for the minimum receive buffer size did not take the tag size into account during decryption. Fix this by adding the required extra length.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 74a66fdb5282d89e348b00c42cfca3a936946d94Affected d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before fd427dd84f224309afbcc2cb67c7bb770a01265cAffected d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 1c76b5675119f694458293a2a81f40731c69bd32Affected d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before e86ab1e5661386a874fbb8551f0c04b8e9f8ad22Affected d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before af2fa2fbbced26129813274b8b3f7705f280e174Affected d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 78cea133daf721698876e56135049a96d39d610aAffected d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 3afdc15d6173614d7d834517d9b65e7aa5a08548Affected d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 3d14bd48e3a77091cbce637a12c2ae31b4a1687cAffected
LinuxLinux	4.14Affected before 4.14Not affected 5.10.254 through 5.10.Not affected 5.15.204 through 5.15.Not affected 6.1.170 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 74a66fdb5282d89e348b00c42cfca3a936946d94Affected
d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before fd427dd84f224309afbcc2cb67c7bb770a01265cAffected
d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 1c76b5675119f694458293a2a81f40731c69bd32Affected
d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before e86ab1e5661386a874fbb8551f0c04b8e9f8ad22Affected
d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before af2fa2fbbced26129813274b8b3f7705f280e174Affected
d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 78cea133daf721698876e56135049a96d39d610aAffected
d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 3afdc15d6173614d7d834517d9b65e7aa5a08548Affected
d887c52d6ae43aeebd249b5f2f1333e60236aa60 to before 3d14bd48e3a77091cbce637a12c2ae31b4a1687cAffected

LinuxLinux

4.14Affected
before 4.14Not affected
5.10.254 through 5.10.*Not affected
5.15.204 through 5.15.*Not affected
6.1.170 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.