Medium 5.5Published Feb 4, 2026

CVE-2026-23060crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec

Updated under an hour ago (Oct 27, 2026, 3:40 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_authenc_esn_decrypt() can advance past the end of the destination scatterlist and trigger a NULL pointer dereference in scatterwalk_map_and_copy(), leading to a kernel panic (DoS). Add a minimum AAD length check to fail fast on invalid inputs.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 104880a6b470958ddc30e139c41aa4f6ed3a5234 before df22c9a65e9a9daa368a72fed596af9d7d5876bb; from 104880a6b470958ddc30e139c41aa4f6ed3a5234 before fee86edf5803f1d1f19e3b4f2dacac241bddfa48; 104880a6b470958ddc30e139c41aa4f6ed3a5234 builds before 767e8349f7e929b7dd95c08f0b4cb353459b365e; from 104880a6b470958ddc30e139c41aa4f6ed3a5234 before b0a9609283a5c852addb513dafa655c61eebc1ef; 104880a6b470958ddc30e139c41aa4f6ed3a5234 builds before 161bdc90fce25bd9890adc67fa1c8563a7acbf40; 104880a6b470958ddc30e139c41aa4f6ed3a5234 builds before 9532ff0d0e90ff78a214299f594ab9bac81defe4; 104880a6b470958ddc30e139c41aa4f6ed3a5234 builds before 2397e9264676be7794f8f7f1e9763d90bd3c7335	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.3 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; 6.19; 6.19; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/df22c9a65e9a9daa368a72fed596af9d7d5876bb	patch
https://git.kernel.org/stable/c/fee86edf5803f1d1f19e3b4f2dacac241bddfa48	patch
https://git.kernel.org/stable/c/767e8349f7e929b7dd95c08f0b4cb353459b365e	patch
https://git.kernel.org/stable/c/b0a9609283a5c852addb513dafa655c61eebc1ef	patch
https://git.kernel.org/stable/c/161bdc90fce25bd9890adc67fa1c8563a7acbf40	patch
https://git.kernel.org/stable/c/9532ff0d0e90ff78a214299f594ab9bac81defe4	patch
https://git.kernel.org/stable/c/2397e9264676be7794f8f7f1e9763d90bd3c7335	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.