Medium 5.5Published May 6, 2026

CVE-2026-43077crypto: algif_aead - Fix minimum RX size check for decryption

Updated under an hour ago (Oct 26, 2026, 9:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption The check for the minimum receive buffer size did not take the tag size into account during decryption. Fix this by adding the required extra length.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d887c52d6ae43aeebd249b5f2f1333e60236aa60 before 74a66fdb5282d89e348b00c42cfca3a936946d94; from d887c52d6ae43aeebd249b5f2f1333e60236aa60 before fd427dd84f224309afbcc2cb67c7bb770a01265c; from d887c52d6ae43aeebd249b5f2f1333e60236aa60 before 1c76b5675119f694458293a2a81f40731c69bd32; from d887c52d6ae43aeebd249b5f2f1333e60236aa60 before e86ab1e5661386a874fbb8551f0c04b8e9f8ad22; from d887c52d6ae43aeebd249b5f2f1333e60236aa60 before af2fa2fbbced26129813274b8b3f7705f280e174; from d887c52d6ae43aeebd249b5f2f1333e60236aa60 before 78cea133daf721698876e56135049a96d39d610a; from d887c52d6ae43aeebd249b5f2f1333e60236aa60 before 3afdc15d6173614d7d834517d9b65e7aa5a08548; from d887c52d6ae43aeebd249b5f2f1333e60236aa60 before 3d14bd48e3a77091cbce637a12c2ae31b4a1687c	CNA record
linux linux_kernel linux:linux_kernel	from 4.14.1 before 5.10.254; from 5.11 before 5.15.204; from 5.16 before 6.1.170; from 6.2 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 4.14; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/74a66fdb5282d89e348b00c42cfca3a936946d94	patch
https://git.kernel.org/stable/c/fd427dd84f224309afbcc2cb67c7bb770a01265c	patch
https://git.kernel.org/stable/c/1c76b5675119f694458293a2a81f40731c69bd32	patch
https://git.kernel.org/stable/c/e86ab1e5661386a874fbb8551f0c04b8e9f8ad22	patch
https://git.kernel.org/stable/c/af2fa2fbbced26129813274b8b3f7705f280e174	patch
https://git.kernel.org/stable/c/78cea133daf721698876e56135049a96d39d610a	patch
https://git.kernel.org/stable/c/3afdc15d6173614d7d834517d9b65e7aa5a08548	patch
https://git.kernel.org/stable/c/3d14bd48e3a77091cbce637a12c2ae31b4a1687c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.