{"id":"CVE-2026-80843","revision":"abe6cd4b3c1d4b13bbb92833fcea8606","records":[{"revision":"abe6cd4b3c1d4b13bbb92833fcea8606","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80843","aliases":[],"title":"xfrm: fix xfrm_state_construct() auth-trunc leak","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix xfrm_state_construct() auth-trunc leak\n\nattach_auth_trunc() can allocate x->aalg while leaving\nx->props.aalgo at zero when the selected auth algorithm has no\nsadb_alg_id. One real case is cmac(aes).\n\nxfrm_state_construct() then treats !x->props.aalgo as \"no auth\nalgorithm attached yet\" and calls attach_auth(). That overwrites\nx->aalg and loses the first allocation. Any later failure or teardown\nonly frees the replacement pointer.\n\nCheck whether x->aalg is already attached instead of inferring that\nstate from x->props.aalgo.","state":0,"publishedAt":"2026-09-04T15:54:53.328+00:00","modifiedAt":"2026-10-19T08:44:36.352+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xfrm/xfrm_user.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4447bb33f09444920a8f1d89e1540137429351b6\",\n                            \"lessThan\": \"958ae9f261319e1cdc44879886bcda2263258cca\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4447bb33f09444920a8f1d89e1540137429351b6\",\n                            \"lessThan\": \"fb7f3e74789a3c89647f4eb768f6dfaf4a751e72\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4447bb33f09444920a8f1d89e1540137429351b6\",\n                            \"lessThan\": \"ba0c110c205855b3f1e3130d8c0fdb484d704c8c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4447bb33f09444920a8f1d89e1540137429351b6\",\n                            \"lessThan\": \"c8837bbe792257af547fd1c0252553ce13148795\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4447bb33f09444920a8f1d89e1540137429351b6\",\n                            \"lessThan\": \"71d42da01740ec6557837bebec0bc48cfc3b4c39\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4447bb33f09444920a8f1d89e1540137429351b6\",\n                            \"lessThan\": \"cf67361e78dca488d6e4df8396a53e6745a3a80e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4447bb33f09444920a8f1d89e1540137429351b6\",\n                            \"lessThan\": \"37426395cb90ef217beec8407a14bd82153793d3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4447bb33f09444920a8f1d89e1540137429351b6\",\n                            \"lessThan\": \"be19d20e53a239572bb2a28efcc1cd2b069b1ef9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4447bb33f09444920a8f1d89e1540137429351b6\",\n                            \"lessThan\": \"c12cbf56320fb633484ee0ca1fb7d68d6b64b213\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xfrm/xfrm_user.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.33\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.33\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.269\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.220\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.187\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.156\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.108\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.49\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.13\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.3\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/958ae9f261319e1cdc44879886bcda2263258cca","https://git.kernel.org/stable/c/fb7f3e74789a3c89647f4eb768f6dfaf4a751e72","https://git.kernel.org/stable/c/ba0c110c205855b3f1e3130d8c0fdb484d704c8c","https://git.kernel.org/stable/c/c8837bbe792257af547fd1c0252553ce13148795","https://git.kernel.org/stable/c/71d42da01740ec6557837bebec0bc48cfc3b4c39","https://git.kernel.org/stable/c/cf67361e78dca488d6e4df8396a53e6745a3a80e","https://git.kernel.org/stable/c/37426395cb90ef217beec8407a14bd82153793d3","https://git.kernel.org/stable/c/be19d20e53a239572bb2a28efcc1cd2b069b1ef9","https://git.kernel.org/stable/c/c12cbf56320fb633484ee0ca1fb7d68d6b64b213"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80843","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80843","identifiers":["CVE-2026-80843"]},"retained":false,"historicalAffected":[]}],"coverage":[]}