CVE-2026-31677

Vulnerability

In the Linux kernel's crypto subsystem, the function af_alg_get_rsgl() in af_alg.c fails to limit each RX scatterlist extraction to the remaining receive buffer budget. It uses af_alg_readable() only as a gate before extracting data, but does not cap the extraction size to the remaining af_alg_rcvbuf(sk) budget. This causes receive-side accounting to not match the amount of data attached to the request [1][2][3][4].

Exploitation

An attacker with local access and the ability to perform AF_ALG socket operations can trigger this bug. By sending data that causes the RX scatterlist extraction to exceed the receive buffer budget, the accounting becomes inconsistent. If skcipher cannot obtain enough RX space for at least one chunk while more data remains, the recvmsg call is rejected instead of rounding down to zero, which could lead to denial of service.

Impact

The primary impact is a denial of service due to resource accounting mismatch. The vulnerability has a CVSS v3 score of 5.5 (Medium), indicating moderate severity. An attacker could potentially exhaust receive buffer resources, causing system instability or hang.

Mitigation

The fix has been applied to the Linux kernel stable tree via commits [1][2][3][4]. Users should update to a kernel version containing these patches. No workaround is mentioned.