In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - snapshot IV for async AEAD requests

AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during
request processing. For async requests, later socket activity can
update that shared state before the original request has fully
completed, which can lead to inconsistent IV handling.

Snapshot the IV into per-request storage when preparing the AEAD
request, so in-flight operations no longer depend on mutable socket
state.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
d887c52d6ae43aeebd249b5f2f1333e60236aa60 affected < 08ea39a556ecd39b33c2b4888861001c6706a62e
d887c52d6ae43aeebd249b5f2f1333e60236aa60 affected < a920cabdb0b7cf1f4e11a20524253ae5bd09092b
d887c52d6ae43aeebd249b5f2f1333e60236aa60 affected < fa0fcec9b49d58e71df7ede91ecd86855f608e85
d887c52d6ae43aeebd249b5f2f1333e60236aa60 affected < c2138c9bd02af19e0b407376140cd5435b0d81da
d887c52d6ae43aeebd249b5f2f1333e60236aa60 affected < 46fdb39e83227b5d39f7c934a0947ea913f13c18
d887c52d6ae43aeebd249b5f2f1333e60236aa60 affected < ebc235675f24b0e3f8bc92b8419471d42f837d8f
d887c52d6ae43aeebd249b5f2f1333e60236aa60 affected < 3d72f8c6490dc79210b64270740cb2a8619361a4
d887c52d6ae43aeebd249b5f2f1333e60236aa60 affected < 5aa58c3a572b3e3b6c786953339f7978b845cc52
Linux Linux affected
Version Status Constraints
4.14 affected —
0 unaffected < 4.14
5.10.254 unaffected ≤ 5.10.*
5.15.204 unaffected ≤ 5.15.*
6.1.170 unaffected ≤ 6.1.*
6.6.137 unaffected ≤ 6.6.*
6.12.85 unaffected ≤ 6.12.*
6.18.27 unaffected ≤ 6.18.*
7.0.4 unaffected ≤ 7.0.*
7.1-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/08ea39a556ecd39b33c2b4888861001c6706a62e cve-icon cve-icon
https://git.kernel.org/stable/c/3d72f8c6490dc79210b64270740cb2a8619361a4 cve-icon cve-icon
https://git.kernel.org/stable/c/46fdb39e83227b5d39f7c934a0947ea913f13c18 cve-icon cve-icon
https://git.kernel.org/stable/c/5aa58c3a572b3e3b6c786953339f7978b845cc52 cve-icon cve-icon
https://git.kernel.org/stable/c/a920cabdb0b7cf1f4e11a20524253ae5bd09092b cve-icon cve-icon
https://git.kernel.org/stable/c/c2138c9bd02af19e0b407376140cd5435b0d81da cve-icon cve-icon
https://git.kernel.org/stable/c/ebc235675f24b0e3f8bc92b8419471d42f837d8f cve-icon cve-icon
https://git.kernel.org/stable/c/fa0fcec9b49d58e71df7ede91ecd86855f608e85 cve-icon cve-icon
History

Wed, 27 May 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1344
CWE-362

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - snapshot IV for async AEAD requests AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during request processing. For async requests, later socket activity can update that shared state before the original request has fully completed, which can lead to inconsistent IV handling. Snapshot the IV into per-request storage when preparing the AEAD request, so in-flight operations no longer depend on mutable socket state.
Title crypto: algif_aead - snapshot IV for async AEAD requests
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-27T12:56:36.847Z

Reserved: 2026-05-13T15:03:33.093Z

Link: CVE-2026-46028

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:21.420

Modified: 2026-05-27T14:48:03.013

Link: CVE-2026-46028

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T21:30:34Z

Weaknesses