Description
In the Linux kernel, the following vulnerability has been resolved:

crypto: tegra - Add missing CRYPTO_ALG_ASYNC

The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its
asynchronous algorithms, causing the crypto API to select them for users
that request only synchronous algorithms. This causes crashes (at
least). Fix this by adding the flag like what the other drivers do.
Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just
get ignored and overridden by the registration function anyway.
Published: 2026-05-01
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The tegra crypto driver failed to mark its asynchronous algorithms with the CRYPTO_ALG_ASYNC flag. Because of this omission the Linux kernel’s crypto API mistakenly directed synchronous requests to those async algorithms, which caused kernel crashes. The resulting denial of service can bring down any process that relies on the synchronous crypto path, potentially destabilizing services and the entire system.

Affected Systems

The flaw is confined to the Linux kernel’s tegra crypto driver, which is used on NVIDIA Tegra platforms. All kernel releases that contain the driver before the patch commits listed in the supplied references are affected. Any system running an unpatched kernel with this driver is vulnerable.

Risk and Exploitability

No CVSS score is supplied and the EPSS score is unavailable, but the vulnerability is not listed in the CISA KEV catalog and no public exploits are known. The crash requires an attacker to successfully issue a synchronous crypto request that the kernel misroutes to an async algorithm, a scenario that would normally need local or privileged kernel access. Consequently, the risk is moderate and primarily a denial‑of‑service concern rather than a remote code execution vector.

Generated by OpenCVE AI on May 1, 2026 at 23:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Linux kernel that includes the tegra driver patch references c3aea268b, 429d0556, 4b56770d, and bdbf027a
  • Verify the kernel configuration enables the tegra crypto driver and that the CRYPTO_ALG_ASYNC flag is set for all asynchronous algorithms
  • If a kernel update is not immediately available, restrict or disable use of synchronous crypto calls that might trigger the crash, or disable the tegra crypto module if it is not required for your workloads

Generated by OpenCVE AI on May 1, 2026 at 23:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 02 May 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-166
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate


Sat, 02 May 2026 00:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-746

Fri, 01 May 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This causes crashes (at least). Fix this by adding the flag like what the other drivers do. Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the registration function anyway.
Title crypto: tegra - Add missing CRYPTO_ALG_ASYNC
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-01T14:14:35.551Z

Reserved: 2026-03-09T15:48:24.138Z

Link: CVE-2026-31739

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-01T15:16:36.600

Modified: 2026-05-01T15:24:14.893

Link: CVE-2026-31739

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-05-01T00:00:00Z

Links: CVE-2026-31739 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T23:45:09Z

Weaknesses