CVE-2026-43043

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43043", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.979Z", "datePublished": "2026-05-01T14:15:39.576Z", "dateUpdated": "2026-11-06T15:32:28.084Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:16:36.820Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af-alg - fix NULL pointer dereference in scatterwalk\n\nThe AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)\nwhen chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL\nexactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent\nsendmsg() allocates a new SGL and chains it, but fails to clear the end\nmarker on the previous SGL's last data entry.\n\nThis causes the crypto scatterwalk to hit a premature end, returning NULL\non sg_next() and leading to a kernel panic during dereference.\n\nFix this by explicitly unmarking the end of the previous SGL when\nperforming sg_chain() in af_alg_alloc_tsgl()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/af_alg.c"], "versions": [{"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "f48d3dd99199180cf37d6253550c55e86372309a", "status": "affected", "versionType": "git"}, {"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "f9acceae7b004956851fd4268edf9f518a9bce04", "status": "affected", "versionType": "git"}, {"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "7195350fb78538c25cd790d703f8f2c73ee0d395", "status": "affected", "versionType": "git"}, {"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49", "status": "affected", "versionType": "git"}, {"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "44eafa39363e8d5dfda6a8c6eb6b45458ed4b948", "status": "affected", "versionType": "git"}, {"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "00cbdec17c15d024a1c5002c7365df7624a18a75", "status": "affected", "versionType": "git"}, {"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "4b03ab0a587ec57eb7ddb5c115d84a42896f60f7", "status": "affected", "versionType": "git"}, {"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "62397b493e14107ae82d8b80938f293d95425bcb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/af_alg.c"], "versions": [{"version": "2.6.38", "status": "affected"}, {"version": "0", "lessThan": "2.6.38", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f48d3dd99199180cf37d6253550c55e86372309a"}, {"url": "https://git.kernel.org/stable/c/f9acceae7b004956851fd4268edf9f518a9bce04"}, {"url": "https://git.kernel.org/stable/c/7195350fb78538c25cd790d703f8f2c73ee0d395"}, {"url": "https://git.kernel.org/stable/c/7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49"}, {"url": "https://git.kernel.org/stable/c/44eafa39363e8d5dfda6a8c6eb6b45458ed4b948"}, {"url": "https://git.kernel.org/stable/c/00cbdec17c15d024a1c5002c7365df7624a18a75"}, {"url": "https://git.kernel.org/stable/c/4b03ab0a587ec57eb7ddb5c115d84a42896f60f7"}, {"url": "https://git.kernel.org/stable/c/62397b493e14107ae82d8b80938f293d95425bcb"}], "title": "crypto: af-alg - fix NULL pointer dereference in scatterwalk", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43043", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:27:04.710209Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:32:28.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43043", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:27:04.710209Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:27:06.163Z"}}], "cna": {"title": "crypto: af-alg - fix NULL pointer dereference in scatterwalk", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "f48d3dd99199180cf37d6253550c55e86372309a", "versionType": "git"}, {"status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "f9acceae7b004956851fd4268edf9f518a9bce04", "versionType": "git"}, {"status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "7195350fb78538c25cd790d703f8f2c73ee0d395", "versionType": "git"}, {"status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49", "versionType": "git"}, {"status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "44eafa39363e8d5dfda6a8c6eb6b45458ed4b948", "versionType": "git"}, {"status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "00cbdec17c15d024a1c5002c7365df7624a18a75", "versionType": "git"}, {"status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "4b03ab0a587ec57eb7ddb5c115d84a42896f60f7", "versionType": "git"}, {"status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "62397b493e14107ae82d8b80938f293d95425bcb", "versionType": "git"}], "programFiles": ["crypto/af_alg.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.38"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.38", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.134", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.81", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["crypto/af_alg.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f48d3dd99199180cf37d6253550c55e86372309a"}, {"url": "https://git.kernel.org/stable/c/f9acceae7b004956851fd4268edf9f518a9bce04"}, {"url": "https://git.kernel.org/stable/c/7195350fb78538c25cd790d703f8f2c73ee0d395"}, {"url": "https://git.kernel.org/stable/c/7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49"}, {"url": "https://git.kernel.org/stable/c/44eafa39363e8d5dfda6a8c6eb6b45458ed4b948"}, {"url": "https://git.kernel.org/stable/c/00cbdec17c15d024a1c5002c7365df7624a18a75"}, {"url": "https://git.kernel.org/stable/c/4b03ab0a587ec57eb7ddb5c115d84a42896f60f7"}, {"url": "https://git.kernel.org/stable/c/62397b493e14107ae82d8b80938f293d95425bcb"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af-alg - fix NULL pointer dereference in scatterwalk\n\nThe AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)\nwhen chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL\nexactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent\nsendmsg() allocates a new SGL and chains it, but fails to clear the end\nmarker on the previous SGL's last data entry.\n\nThis causes the crypto scatterwalk to hit a premature end, returning NULL\non sg_next() and leading to a kernel panic during dereference.\n\nFix this by explicitly unmarking the end of the previous SGL when\nperforming sg_chain() in af_alg_alloc_tsgl()."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.168", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.134", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.81", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.22", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.12", "versionStartIncluding": "2.6.38"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "2.6.38"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:16:36.820Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43043", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:32:28.084Z", "dateReserved": "2026-05-01T14:12:55.979Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-01T14:15:39.576Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["crypto/af_alg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f48d3dd99199180cf37d6253550c55e86372309a", "status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "versionType": "git"}, {"lessThan": "f9acceae7b004956851fd4268edf9f518a9bce04", "status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "versionType": "git"}, {"lessThan": "7195350fb78538c25cd790d703f8f2c73ee0d395", "status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "versionType": "git"}, {"lessThan": "7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49", "status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "versionType": "git"}, {"lessThan": "44eafa39363e8d5dfda6a8c6eb6b45458ed4b948", "status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "versionType": "git"}, {"lessThan": "00cbdec17c15d024a1c5002c7365df7624a18a75", "status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "versionType": "git"}, {"lessThan": "4b03ab0a587ec57eb7ddb5c115d84a42896f60f7", "status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "versionType": "git"}, {"lessThan": "62397b493e14107ae82d8b80938f293d95425bcb", "status": "affected", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["crypto/af_alg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.38"}, {"lessThan": "2.6.38", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "23469A4A-A411-46B7-BCC8-630D832E78C2", "versionEndExcluding": "5.10.253", "versionStartIncluding": "2.6.38", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af-alg - fix NULL pointer dereference in scatterwalk\n\nThe AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)\nwhen chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL\nexactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent\nsendmsg() allocates a new SGL and chains it, but fails to clear the end\nmarker on the previous SGL's last data entry.\n\nThis causes the crypto scatterwalk to hit a premature end, returning NULL\non sg_next() and leading to a kernel panic during dereference.\n\nFix this by explicitly unmarking the end of the previous SGL when\nperforming sg_chain() in af_alg_alloc_tsgl()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: af-alg - corrige desreferencia de puntero NULL en scatterwalk\n\nLa interfaz AF_ALG no desmarca el final de una Lista de Dispersi\u00f3n/Recopilaci\u00f3n (SGL) al encadenar una nueva estructura af_alg_tsgl. Si un sendmsg() llena una SGL exactamente hasta MAX_SGL_ENTS, la \u00faltima entrada se marca como el final. Un sendmsg() posterior asigna una nueva SGL y la encadena, pero no borra el marcador de final en la \u00faltima entrada de datos de la SGL anterior.\n\nEsto provoca que el scatterwalk de criptograf\u00eda alcance un final prematuro, devolviendo NULL en sg_next() y provocando un kernel panic durante la desreferencia.\n\nSoluciona esto desmarcando expl\u00edcitamente el final de la SGL anterior al realizar sg_chain() en af_alg_alloc_tsgl()."}], "id": "CVE-2026-43043", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43043", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:27:04.710209Z", "version": "2.0.3"}}]}, "published": "2026-05-01T15:16:50.563", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/00cbdec17c15d024a1c5002c7365df7624a18a75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/44eafa39363e8d5dfda6a8c6eb6b45458ed4b948"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4b03ab0a587ec57eb7ddb5c115d84a42896f60f7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/62397b493e14107ae82d8b80938f293d95425bcb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7195350fb78538c25cd790d703f8f2c73ee0d395"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f48d3dd99199180cf37d6253550c55e86372309a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f9acceae7b004956851fd4268edf9f518a9bce04"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: crypto: af-alg - fix NULL pointer dereference in scatterwalk", "id": "2464487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464487"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's af-alg subsystem. When the AF_ALG interface chains a new af_alg_tsgl structure, it fails to unmark the end of a Scatter/Gather List (SGL). This can lead to a NULL pointer dereference during a subsequent sendmsg() operation, causing a kernel panic and resulting in a Denial of Service (DoS)."], "name": "CVE-2026-43043", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43043\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43043\nhttps://lore.kernel.org/linux-cve-announce/2026050104-CVE-2026-43043-6997@gregkh/T"], "statement": "This Moderate impact flaw in the Linux kernel's `af-alg` subsystem can lead to a Denial of Service. A local attacker could trigger a kernel panic by exploiting a NULL pointer dereference when the `AF_ALG` interface fails to correctly manage Scatter/Gather Lists, impacting system availability.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ff590903d5fc7f5a0a988c38267a3d08e6393a2,f48d3dd99199180cf37d6253550c55e86372309a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ff590903d5fc7f5a0a988c38267a3d08e6393a2,f9acceae7b004956851fd4268edf9f518a9bce04)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ff590903d5fc7f5a0a988c38267a3d08e6393a2,7195350fb78538c25cd790d703f8f2c73ee0d395)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ff590903d5fc7f5a0a988c38267a3d08e6393a2,7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ff590903d5fc7f5a0a988c38267a3d08e6393a2,44eafa39363e8d5dfda6a8c6eb6b45458ed4b948)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ff590903d5fc7f5a0a988c38267a3d08e6393a2,00cbdec17c15d024a1c5002c7365df7624a18a75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ff590903d5fc7f5a0a988c38267a3d08e6393a2,4b03ab0a587ec57eb7ddb5c115d84a42896f60f7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ff590903d5fc7f5a0a988c38267a3d08e6393a2,62397b493e14107ae82d8b80938f293d95425bcb)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.38"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.38)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.168,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.134,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T19:00:08.007743+00:00", "updated": "2026-05-02T07:15:16.277207+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}