PT-2026-34274 · Linux+4 · Linux Kernel+4
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 7.0
Linux kernel versions prior to 6.19.12
Description
A flaw exists in the
algif aead cryptographic algorithm interface of the Linux kernel. The issue stems from an incorrect in-place operation during cryptographic processing where source and destination data mappings differ. A local attacker with low privileges can exploit this by splicing a readable file into an AF ALG socket and requesting an AEAD operation. This allows the attacker to perform a deterministic 4-byte write directly into the kernel's page cache, which is the in-memory copy of any file the user can read.Because the page cache is shared between containers and the host, this can be used to corrupt sensitive system files (such as
/usr/bin/su or /usr/sbin/ipset) in memory without altering the file on disk. This enables the attacker to bypass file integrity checks and escalate privileges to root. In Kubernetes environments, this can lead to a container escape where an unprivileged container achieves node-level code execution by corrupting a binary shared with a privileged DaemonSet, such as kube-proxy.Recommendations
Update the Linux kernel to version 7.0 or 6.19.12 or newer.
As a temporary mitigation in Kubernetes environments, restrict pod scheduling to prevent untrusted workloads from landing on nodes running privileged DaemonSets that share base images.
Exploit
Fix
DoS
LPE
RCE
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Red Os
Rocky Linux
Ubuntu