PT-2026-43895 · Linux+2 · Linux Kernel+2

Published

2026-05-27

·

Updated

2026-06-16

·

CVE-2026-46028

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description An issue exists in the algif aead component where AF ALG AEAD AIO requests utilize a socket-wide IV (Initialization Vector) buffer during processing. For asynchronous requests, subsequent socket activity may update this shared state before the initial request completes, resulting in inconsistent IV handling. This occurs because in-flight operations depend on mutable socket state rather than a dedicated snapshot of the IV.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-46028
OPENSUSE-SU-2026:10954-1
USN-8350-1
USN-8351-1
USN-8374-1
USN-8391-1
USN-8392-1
USN-8393-1
USN-8426-1
USN-8426-2
USN-8440-1

Affected Products

Linuxmint
Linux Kernel
Ubuntu