CVE-2026-53016

crypto: ccp - copy IV using skcipher ivsize

State: Published
Severity: 7.8 High
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - copy IV using skcipher ivsize

AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.

ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer while RFC3686 skciphers expose an 8-byte IV, so the restore overruns the provided buffer.

Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-805 Buffer Access with Incorrect Length Value

Affected Products

Product	Versions
LinuxLinux	2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before 939061b2d0f7f15114e34b4ce878ef50ff4089c3Affected 2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before 798d409a8949f3f495f238549b86de2886b129bdAffected 2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before dfb2cf434829819268fe50f41542aad318ad62b2Affected 2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before eecee15e263ccb8cd77170a56ab6c969cb54dd6aAffected 2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before bb01d8f1f385bc9034ca114d3508c7fdea24fc9aAffected 2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before df9784bb5b637ac80f4a2768a58ca9a50bef28a9Affected 2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before 227c1e1d9e2aa4cfc65ba446d5690da1f546cda4Affected 2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4Affected
LinuxLinux	3.14Affected before 3.14Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before 939061b2d0f7f15114e34b4ce878ef50ff4089c3Affected
2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before 798d409a8949f3f495f238549b86de2886b129bdAffected
2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before dfb2cf434829819268fe50f41542aad318ad62b2Affected
2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before eecee15e263ccb8cd77170a56ab6c969cb54dd6aAffected
2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before bb01d8f1f385bc9034ca114d3508c7fdea24fc9aAffected
2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before df9784bb5b637ac80f4a2768a58ca9a50bef28a9Affected
2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before 227c1e1d9e2aa4cfc65ba446d5690da1f546cda4Affected
2b789435d7f36ed918d92db647f3a2f3fec9bb1f to before a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4Affected

LinuxLinux

3.14Affected
before 3.14Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.