Unrated severityNVD Advisory· Published Jan 14, 2026· Updated Feb 9, 2026
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
CVE-2025-71131
Description
In the Linux kernel, the following vulnerability has been resolved:
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
As soon as crypto_aead_encrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid.
Instead of checking req->iv against info, create a new variable unaligned_info and use it for that purpose instead.
Affected products
2- Linux/Linuxv5Range: 2.6.25
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- git.kernel.org/stable/c/0279978adec6f1296af66b642cce641c6580be46mitre
- git.kernel.org/stable/c/18202537856e0fae079fed2c9308780bcff2bb9dmitre
- git.kernel.org/stable/c/50f196d2bbaee4ab2494bb1b0d294deba292951amitre
- git.kernel.org/stable/c/50fdb78b7c0bcc550910ef69c0984e751cac72famitre
- git.kernel.org/stable/c/5476f7f8a311236604b78fcc5b2a63b3a61b0169mitre
- git.kernel.org/stable/c/baf0e2d1e03ddb04781dfe7f22a654d3611f69b2mitre
- git.kernel.org/stable/c/ccbb96434d88e32358894c879457b33f7508e798mitre
News mentions
0No linked articles in our index yet.