PT-2026-36460 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-06-05 · CVE-2026-43043

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The AF ALG interface fails to unmark the end of a Scatter/Gather List (SGL) when chaining a new af alg tsgl structure. If the sendmsg() function fills an SGL exactly to MAX SGL ENTS, the last entry is marked as the end. A subsequent sendmsg() call allocates and chains a new SGL but does not clear the end marker on the previous SGL's last data entry. This results in the crypto scatterwalk reaching a premature end and returning NULL on the sg next() function, which leads to a kernel panic during dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-43043

ECHO-F0AE-BE67-70F6

OESA-2026-2581

Affected Products

Linux Kernel

References · 121

• https://nvd.nist.gov/vuln/detail/CVE-2025-23145 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31398 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31698 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23473 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-71239 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31628 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31467 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23102 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31532 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-71094 · Security Note
• https://git.kernel.org/stable/c/62397b493e14107ae82d8b80938f293d95425bcb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43148 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31518 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31496 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31452 · Security Note