CVE-2026-43493

Vulnerability

In the Linux kernel's crypto/pcrypt subsystem, a flaw exists in how MAY_BACKLOG requests are handled. Requests with the MAY_BACKLOG flag can return -EBUSY when the crypto backend is congested; however, the pcrypt code did not check for this return value and incorrectly filtered out EINPROGRESS notifications. This bug affects multiple stable kernel versions as indicated by the patches anchored at commits [1], [2], [3], and [4].

Exploitation

An attacker able to submit MAY_BACKLOG requests to the pcrypt subsystem (e.g., via a local process making AF_ALG socket calls or through other crypto operations that reach pcrypt) can trigger a race condition. When the backend returns -EBUSY, the missing error handling causes the request to be treated as completed prematurely, potentially leading to use of freed memory or double completion. No special privileges are required if the attacker has local access and the kernel is configured with pcrypt.

Impact

Successful exploitation can lead to memory corruption, a kernel crash (denial of service), or potentially arbitrary code execution due to use-after-free of crypto request structures. The CVSS v3 score of 9.8 (Critical) reflects the possibility of remote exploitation if the attack surface is reachable over the network, though the primary vector is local. The impact includes complete loss of confidentiality, integrity, and availability.

Mitigation

The vulnerability is fixed by applying the kernel patches referenced in commits [1], [2], [3], and [4]. System administrators should update to the latest stable kernels containing these fixes as soon as possible. If a kernel update is not immediately feasible, the pcrypt module can be blacklisted via /etc/modprobe.d/blacklist.conf as a workaround, provided it is not required for operation. No evidence of inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog was found at the time of writing.