CVE-2026-68125 - Vulnerability Details

- mac802154: llsec: reject frames shorter than the authentication tag

Description

In the Linux kernel, the following vulnerability has been resolved:

mac802154: llsec: reject frames shorter than the authentication tag

llsec_do_decrypt_auth() computes the associated-data length for the
AEAD request as

assoclen += datalen - authlen;

where datalen is the number of bytes after the MAC header and authlen
(4, 8 or 16) is the length of the authentication tag. Nothing verifies
that the frame actually carries at least authlen payload bytes. A
secured frame whose payload is shorter than the tag makes
datalen - authlen negative; assoclen is then passed to
aead_request_set_ad() as an unsigned value close to 4 GiB, so
crypto_aead_decrypt() walks far off the end of the scatterlist that
only spans the real frame.

The frame is fully attacker-controlled and reaches this path from any
IEEE 802.15.4 peer in radio range. Reject frames whose payload is
shorter than the authentication tag before the subtraction.

Dynamically reproduced on a KASAN kernel as a general-protection-fault
in the AEAD scatterwalk, and the fix confirmed.

Published: 2026-08-10

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability occurs in the Linux kernel’s mac802154 subsystem, where the authentication tag length is not validated against the actual payload size. A crafted IEEE 802.15. payload shorter than the authentication tag causes a negative subtraction that is interpreted as an unsigned value near 4 GiB. This value is passed to the cryptographic AEAD layer, leading the kernel to read far beyond the end of the scatterlist and eventually trigger a general‑protection fault, crashing the system. The impact is a denial of service, as the crash can be repeatedly induced by any radio peer within range.

Affected Systems

The issue affects all Linux kernels that implement the mac802154 llsec code path, specifically those in the Linux:Linux CNA list. No specific version range is listed, but any kernel that contains the unpatched llsec_do_decrypt_auth logic is vulnerable. The CVE references commit identifiers that are present in recent stable kernel branches.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, so no confirmed exploits are reported. Attackers can trigger the flaw from any IEEE 802.15.4 peer within radio range, requiring only passive radio reception to deliver the malicious frame, making the attack vector local but trivial to craft.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4c14a2fb5d143e4ed94143be2b8c1961b47df9af`	affected	< f27ce82eb04960465df71634b196a48a4ecafd50
`4c14a2fb5d143e4ed94143be2b8c1961b47df9af`	affected	< 2d6b42a61373144298070668fddf06efe79cf2ff
`4c14a2fb5d143e4ed94143be2b8c1961b47df9af`	affected	< ec7e62d77193131227df49d654d118fdf5a59892
`4c14a2fb5d143e4ed94143be2b8c1961b47df9af`	affected	< 5bbf0cd9b6a7076af86c75e87e180099be2e11ae
`4c14a2fb5d143e4ed94143be2b8c1961b47df9af`	affected	< de80808f37d99c6dc67bb6f97eea00c8f57a8821
`4c14a2fb5d143e4ed94143be2b8c1961b47df9af`	affected	< f20dedce0429b293d4bad604e0d3f65d8ac96c83
`4c14a2fb5d143e4ed94143be2b8c1961b47df9af`	affected	< e09e0301d616c1ef38a5e64e8e4326fd39df13cc
`4c14a2fb5d143e4ed94143be2b8c1961b47df9af`	affected	< fd3a3f28ed60c6af4b2a39933b151d6b27842c3b

Linux

affected

Version	Status	Constraints
`3.16`	affected	—
`0`	unaffected	< 3.16
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4c14a2fb5d143e4ed94143be2b8c1961b47df9af,5bbf0cd9b6a7076af86c75e87e180099be2e11ae)`	affected	code_commit	—
`[4c14a2fb5d143e4ed94143be2b8c1961b47df9af,de80808f37d99c6dc67bb6f97eea00c8f57a8821)`	affected	code_commit	—
`[4c14a2fb5d143e4ed94143be2b8c1961b47df9af,f20dedce0429b293d4bad604e0d3f65d8ac96c83)`	affected	code_commit	—
`[4c14a2fb5d143e4ed94143be2b8c1961b47df9af,e09e0301d616c1ef38a5e64e8e4326fd39df13cc)`	affected	code_commit	—
`[4c14a2fb5d143e4ed94143be2b8c1961b47df9af,fd3a3f28ed60c6af4b2a39933b151d6b27842c3b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.16`	affected	generic	—
`[0,3.16)`	unaffected	generic	—
`[6.6.148,7.0.0)`	unaffected	semver	—
`[6.12.101,7.0.0)`	unaffected	semver	—
`[6.18.42,7.0.0)`	unaffected	semver	—
`[7.1.6,8.0.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to the latest stable release that includes the commit which rejects frames shorter than the authentication tag (commits are available in the provided git references).
Ensure that the kernel build includes KASAN or equivalent memory safety mechanisms if the vendor kernel is not up‑to‑date, as this will detect and mitigate accidental out‑of‑bounds accesses.
If a kernel upgrade is not immediately feasible, configure the IEEE 802.15.4 interface or radio firmware to drop or blacklist traffic from untrusted devices, preventing the vulnerable frame from reaching the kernel’s security module.

Generated by OpenCVE AI on August 14, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0032.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2d6b42a61373144298070668fddf06efe79cf2ff
https://git.kernel.org/stable/c/5bbf0cd9b6a7076af86c75e87e180099be2e11ae
https://git.kernel.org/stable/c/de80808f37d99c6dc67bb6f97eea00c8f57a8821
https://git.kernel.org/stable/c/e09e0301d616c1ef38a5e64e8e4326fd39df13cc
https://git.kernel.org/stable/c/ec7e62d77193131227df49d654d118fdf5a59892
https://git.kernel.org/stable/c/f20dedce0429b293d4bad604e0d3f65d8ac96c83
https://git.kernel.org/stable/c/f27ce82eb04960465df71634b196a48a4ecafd50
https://git.kernel.org/stable/c/fd3a3f28ed60c6af4b2a39933b151d6b27842c3b
https://nvd.nist.gov/vuln/detail/CVE-2026-68125
https://www.cve.org/CVERecord?id=CVE-2026-68125

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2d6b42a61373144298070668fddf06efe79cf2ff https://git.kernel.org/stable/c/ec7e62d77193131227df49d654d118fdf5a59892 https://git.kernel.org/stable/c/f27ce82eb04960465df71634b196a48a4ecafd50

Fri, 14 Aug 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-787

Thu, 13 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68125 https://www.cve.org/CVERecord?id=CVE-2026-68125
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-787

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame whose payload is shorter than the tag makes datalen - authlen negative; assoclen is then passed to aead_request_set_ad() as an unsigned value close to 4 GiB, so crypto_aead_decrypt() walks far off the end of the scatterlist that only spans the real frame. The frame is fully attacker-controlled and reaches this path from any IEEE 802.15.4 peer in radio range. Reject frames whose payload is shorter than the authentication tag before the subtraction. Dynamically reproduced on a KASAN kernel as a general-protection-fault in the AEAD scatterwalk, and the fix confirmed.
Title		mac802154: llsec: reject frames shorter than the authentication tag
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5bbf0cd9b6a7076af86c75e87e180099be2e11ae https://git.kernel.org/stable/c/de80808f37d99c6dc67bb6f97eea00c8f57a8821 https://git.kernel.org/stable/c/e09e0301d616c1ef38a5e64e8e4326fd39df13cc https://git.kernel.org/stable/c/f20dedce0429b293d4bad604e0d3f65d8ac96c83 https://git.kernel.org/stable/c/fd3a3f28ed60c6af4b2a39933b151d6b27842c3b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T11:58:46.198Z

Updated: 2026-08-19T16:29:39.507Z

Reserved: 2026-07-30T09:28:09.369Z

Link: CVE-2026-68125

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:19:57.690

Modified: 2026-08-19T17:20:30.007

Link: CVE-2026-68125

Redhat

Severity : Moderate

Publid Date: 2026-08-10T11:58:46Z

Links: CVE-2026-68125 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-14T04:00:12Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object