CVE-2026-43033

Vulnerability

Description

CVE-2026-43033 is a vulnerability in the Linux kernel's crypto: authencesn module. The issue occurs during out-of-place decryption (when the source and destination buffers are different). In this scenario, the code incorrectly saves the high-order sequence number (hiseq) at the end of the destination buffer, even though it is unnecessary because the data can be re-copied from the source. This misplaced data can lead to corruption of the decrypted output.

Exploitation

An attacker would need to trigger an out-of-place decryption operation using the authencesn algorithm. This requires the ability to send crafted network packets or data that the kernel processes through this crypto module. No authentication is required beyond the ability to interact with the affected subsystem. The attack surface is local or network-based, depending on how the authencesn algorithm is used (e.g., in IPsec or other cryptographic protocols).

Impact

Successful exploitation could cause data corruption during decryption, potentially leading to system instability or denial of service. The vulnerability has a CVSS v3 score of 7.8.8 (High), indicating significant impact on confidentiality, integrity, and availability.

Mitigation

The fix has been applied in the Linux kernel stable tree via commits [1], [2], [3], and [4]. Users should update to a kernel version containing these patches. No workarounds are documented; the recommended action is to apply the kernel update.