CVE-2026-74578 (GCVE-0-2026-74578)

Vulnerability from cvelistv5 – Published: 2026-08-16 08:20 – Updated: 2026-08-17 05:48
VLAI
Title
crypto: algif_skcipher - force synchronous processing on trees without ctx->state
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_skcipher - force synchronous processing on trees without ctx->state The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv directly into the skcipher request. After io_submit() the socket lock is dropped and the request is processed asynchronously, so a concurrent sendmsg(ALG_SET_IV) can overwrite ctx->iv and make the in-flight request run under an attacker-controlled IV. For CTR/stream modes this is IV/keystream reuse and lets an unprivileged user recover the plaintext of a concurrent operation. Snapshotting ctx->iv into per-request storage for the async path is not sufficient. For ciphers with statesize == 0 - which includes cbc and ctr - the MSG_MORE inter-chunk IV chaining is carried solely by the in-place req->iv writeback, which a snapshot redirects into per-request memory that af_alg_free_resources() releases on completion, silently producing wrong output. Writing the IV back from the completion callback instead is not possible either: that would require lock_sock() there, but the callback can run in softirq/atomic context, so it must not sleep. Make the operation synchronous instead, which removes both the IV race and any writeback race. This is equivalent to the upstream resolution, commit fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the AIO socket path across net/ entirely and so produces the same end state for this file. This patch deviates from that commit deliberately: rather than removing AIO socket support tree-wide, which would be far too invasive for stable, it removes only the AIO branch in crypto/algif_skcipher.c. io_submit() now completes synchronously; AF_ALG async is rarely used in practice. The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless, and is left alone to keep the fix minimal. Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000 after the change; MSG_MORE chunked CTR output bit-identical to single-shot.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < bf09b0be8e851f050e98da702d247c14d81b591a (git)
Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < 73dd3bf704ca6c20639de70c08e9a10bee904a95 (git)
Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < f1a87ca0843d74482402a206ea2dfb315ee9acbd (git)
Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < 7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd (git)
Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < 60eafc7b08c6689ea3ad39eff8d97aefc8a087c7 (git)
Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < d7860b682da55433b5da0591b0e4c1982ecd2689 (git)
Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < b05defc41b27c7d0c05c45f67bf5b91c28f93669 (git)
Affected: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a , < fcc77d33a34cf271702e8daafb6c593e4626776d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/algif_skcipher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf09b0be8e851f050e98da702d247c14d81b591a",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "73dd3bf704ca6c20639de70c08e9a10bee904a95",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "f1a87ca0843d74482402a206ea2dfb315ee9acbd",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "60eafc7b08c6689ea3ad39eff8d97aefc8a087c7",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "d7860b682da55433b5da0591b0e4c1982ecd2689",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "b05defc41b27c7d0c05c45f67bf5b91c28f93669",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "fcc77d33a34cf271702e8daafb6c593e4626776d",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/algif_skcipher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate\n\nThe AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-\u003eiv\ndirectly into the skcipher request. After io_submit() the socket lock is\ndropped and the request is processed asynchronously, so a concurrent\nsendmsg(ALG_SET_IV) can overwrite ctx-\u003eiv and make the in-flight request\nrun under an attacker-controlled IV. For CTR/stream modes this is\nIV/keystream reuse and lets an unprivileged user recover the plaintext of\na concurrent operation.\n\nSnapshotting ctx-\u003eiv into per-request storage for the async path is not\nsufficient. For ciphers with statesize == 0 - which includes cbc and ctr -\nthe MSG_MORE inter-chunk IV chaining is carried solely by the in-place\nreq-\u003eiv writeback, which a snapshot redirects into per-request memory that\naf_alg_free_resources() releases on completion, silently producing wrong\noutput. Writing the IV back from the completion callback instead is not\npossible either: that would require lock_sock() there, but the callback can\nrun in softirq/atomic context, so it must not sleep.\n\nMake the operation synchronous instead, which removes both the IV race and\nany writeback race. This is equivalent to the upstream resolution, commit\nfcc77d33a34c (\"net: Remove support for AIO on sockets\"), which removed the\nAIO socket path across net/ entirely and so produces the same end state for\nthis file. This patch deviates from that commit deliberately: rather than\nremoving AIO socket support tree-wide, which would be far too invasive for\nstable, it removes only the AIO branch in crypto/algif_skcipher.c.\nio_submit() now completes synchronously; AF_ALG async is rarely used in\npractice.\n\nThe -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,\nand is left alone to keep the fix minimal.\n\nTested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000\nafter the change; MSG_MORE chunked CTR output bit-identical to single-shot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls on an AF_ALG skcipher socket (socket/bind/accept/sendmsg plus async recvmsg, io_submit, aio_read, or io_uring read); the bug is not reachable from remote network protocols.\nAC:L - The attacker fully controls the race by running concurrent threads or syscalls on the same socket, timing async recvmsg/io_submit against sendmsg(ALG_SET_IV); pre-fix testing achieved thousands of successful IV injections in 200000 attempts.\nPR:L - Any unprivileged local user can create and use AF_ALG skcipher sockets without CAP_NET_ADMIN or init-namespace root; only standard UNIX discretionary access to the target socket FD is required, which includes same-UID multi-threaded processes.\nUI:N - Exploitation is fully attacker-driven through direct syscalls and requires no victim interaction such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to cryptographic operations on the compromised AF_ALG socket within the attacker\u0027s security context; it does not cross VM, container, or kernel-user authority boundaries like KVM escape or IOMMU bypass.\nC:H - Concurrent IV injection on CTR/stream ciphers causes keystream reuse, letting an attacker recover the full plaintext of an in-flight decrypt/encrypt on the same keyed socket even when the key never leaves kernel memory.\nI:H - Attacker-controlled IV injection corrupts in-flight cipher output and breaks MSG_MORE CBC/CTR chaining (statesize==0), silently producing attacker-influenced ciphertext/plaintext and undermining cryptographic integrity of concurrent operations.\nA:N - The flaw causes information disclosure and silent cryptographic corruption but does not kernel panic, oops, hang, or reliably deny service; availability impact is none beyond possible application-level misbehavior."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:57.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf09b0be8e851f050e98da702d247c14d81b591a"
        },
        {
          "url": "https://git.kernel.org/stable/c/73dd3bf704ca6c20639de70c08e9a10bee904a95"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1a87ca0843d74482402a206ea2dfb315ee9acbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/60eafc7b08c6689ea3ad39eff8d97aefc8a087c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7860b682da55433b5da0591b0e4c1982ecd2689"
        },
        {
          "url": "https://git.kernel.org/stable/c/b05defc41b27c7d0c05c45f67bf5b91c28f93669"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcc77d33a34cf271702e8daafb6c593e4626776d"
        }
      ],
      "title": "crypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74578",
    "datePublished": "2026-08-16T08:20:32.055Z",
    "dateReserved": "2026-08-15T05:44:03.917Z",
    "dateUpdated": "2026-08-17T05:48:57.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74578",
      "date": "2026-08-18",
      "epss": "0.00146",
      "percentile": "0.04395"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74578\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-16T09:16:21.653\",\"lastModified\":\"2026-08-17T06:19:56.270\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate\\n\\nThe AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-\u003eiv\\ndirectly into the skcipher request. After io_submit() the socket lock is\\ndropped and the request is processed asynchronously, so a concurrent\\nsendmsg(ALG_SET_IV) can overwrite ctx-\u003eiv and make the in-flight request\\nrun under an attacker-controlled IV. For CTR/stream modes this is\\nIV/keystream reuse and lets an unprivileged user recover the plaintext of\\na concurrent operation.\\n\\nSnapshotting ctx-\u003eiv into per-request storage for the async path is not\\nsufficient. For ciphers with statesize == 0 - which includes cbc and ctr -\\nthe MSG_MORE inter-chunk IV chaining is carried solely by the in-place\\nreq-\u003eiv writeback, which a snapshot redirects into per-request memory that\\naf_alg_free_resources() releases on completion, silently producing wrong\\noutput. Writing the IV back from the completion callback instead is not\\npossible either: that would require lock_sock() there, but the callback can\\nrun in softirq/atomic context, so it must not sleep.\\n\\nMake the operation synchronous instead, which removes both the IV race and\\nany writeback race. This is equivalent to the upstream resolution, commit\\nfcc77d33a34c (\\\"net: Remove support for AIO on sockets\\\"), which removed the\\nAIO socket path across net/ entirely and so produces the same end state for\\nthis file. This patch deviates from that commit deliberately: rather than\\nremoving AIO socket support tree-wide, which would be far too invasive for\\nstable, it removes only the AIO branch in crypto/algif_skcipher.c.\\nio_submit() now completes synchronously; AF_ALG async is rarely used in\\npractice.\\n\\nThe -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,\\nand is left alone to keep the fix minimal.\\n\\nTested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000\\nafter the change; MSG_MORE chunked CTR output bit-identical to single-shot.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"crypto/algif_skcipher.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a\",\"lessThan\":\"bf09b0be8e851f050e98da702d247c14d81b591a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a\",\"lessThan\":\"73dd3bf704ca6c20639de70c08e9a10bee904a95\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a\",\"lessThan\":\"f1a87ca0843d74482402a206ea2dfb315ee9acbd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a\",\"lessThan\":\"7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a\",\"lessThan\":\"60eafc7b08c6689ea3ad39eff8d97aefc8a087c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a\",\"lessThan\":\"d7860b682da55433b5da0591b0e4c1982ecd2689\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a\",\"lessThan\":\"b05defc41b27c7d0c05c45f67bf5b91c28f93669\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a\",\"lessThan\":\"fcc77d33a34cf271702e8daafb6c593e4626776d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"crypto/algif_skcipher.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/60eafc7b08c6689ea3ad39eff8d97aefc8a087c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/73dd3bf704ca6c20639de70c08e9a10bee904a95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b05defc41b27c7d0c05c45f67bf5b91c28f93669\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf09b0be8e851f050e98da702d247c14d81b591a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d7860b682da55433b5da0591b0e4c1982ecd2689\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f1a87ca0843d74482402a206ea2dfb315ee9acbd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fcc77d33a34cf271702e8daafb6c593e4626776d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T13:44:11+00:00",
      "cve": "CVE-2026-74578",
      "id": "CVE-2026-74578",
      "initial_release_date": "2026-08-16T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: crypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74578.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.