CVE-2026-46028

The vulnerability originates from the Linux kernel cryptographic subsystem handling asynchronous AEAD requests. The implementation currently relies on a shared socket‑wide IV buffer. While a request is in‑flight, other socket activity can overwrite that buffer, causing the original request to use an incorrect or stale IV. This race condition can lead to improper encryption or decryption, resulting in data corruption, loss of confidentiality, or loss of integrity for the affected data streams. The flaw is a race condition and can cause buffer overwrites due to concurrency (CWE‑367).

All installations of the generic Linux kernel that have not been updated with the fix are affected. The flaw exists in the kernel’s AF_ALG AEAD async module and is not limited to a specific release; any current or future kernel running the unpatched subsystem is vulnerable.

The CVSS score of 5.5 indicates a medium severity, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to introduce or manipulate asynchronous AEAD operations on the target system, typically implying local or privileged access. The likely attack vector is local or privileged execution to initiate async AEAD requests. Once the race condition is triggered, the resulting incorrect IV can cause decryption failures or leakage of plaintext, thereby compromising the integrity and confidentiality of any encrypted data processed by the kernel.