CVE-2026-43078

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43078", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.983Z", "datePublished": "2026-05-06T07:40:15.092Z", "dateUpdated": "2026-10-19T19:06:12.864Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:48.958Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl\n\nWhen page reassignment was added to af_alg_pull_tsgl the original\nloop wasn't updated so it may try to reassign one more page than\nnecessary.\n\nAdd the check to the reassignment so that this does not happen.\n\nAlso update the comment which still refers to the obsolete offset\nargument."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable AF_ALG skcipher/AEAD path is reached through local socket syscalls such as socket, bind, accept, sendmsg/sendmmsg, and recvmsg. It is not reachable directly from remote network input.\nAC:L - An attacker controls the AF_ALG socket state, TX scatterlist layout, and recv length needed to end processing on an SG boundary and trigger the zero-length reassignment. No race or external timing condition is required.\nPR:L - Creating and using PF_ALG sockets for userspace crypto does not require real root or administrative capabilities. A basic unprivileged local user can reach the affected code.\nUI:N - Exploitation only requires attacker-issued syscalls on the attacker's own AF_ALG socket. No victim action is needed.\nS:U - The corruption occurs inside the kernel and impacts the same kernel security authority. This is standard local kernel attack surface rather than a VM or hardware boundary escape.\nC:H - The bug is kernel heap memory corruption immediately past an allocated scatterlist object. Following the higher-severity rule, this can plausibly be leveraged for kernel memory disclosure.\nI:H - The pre-fix code writes a scatterlist entry past the allocated destination array via sg_set_page. This is an out-of-bounds kernel heap write and can plausibly support privilege escalation or control-flow/object corruption.\nA:H - The issue is directly observed as a KASAN slab-out-of-bounds crash in af_alg_pull_tsgl from recvmsg. Repeated triggering can crash or destabilize the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/af_alg.c"], "versions": [{"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e", "status": "affected", "versionType": "git"}, {"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "2b781d1d4f933990318bcc5c68fb75a717379e42", "status": "affected", "versionType": "git"}, {"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "f7826bc0b39928a4a22f6b815dd9940b22a63503", "status": "affected", "versionType": "git"}, {"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "710a4ce5d7afd9fe082c75dec282ab4a11c0fe71", "status": "affected", "versionType": "git"}, {"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "c8369a6d62f5abde9cbd4b62c45bf4b996be2468", "status": "affected", "versionType": "git"}, {"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f", "status": "affected", "versionType": "git"}, {"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "9532501e0f1b200ea80baa0e33e0b06da10bb271", "status": "affected", "versionType": "git"}, {"version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "31d00156e50ecad37f2cb6cbf04aaa9a260505ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/af_alg.c"], "versions": [{"version": "4.14", "status": "affected"}, {"version": "0", "lessThan": "4.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.254", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.204", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.170", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.137", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.85", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.10.254"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.15.204"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.1.170"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.6.137"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.12.85"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e"}, {"url": "https://git.kernel.org/stable/c/2b781d1d4f933990318bcc5c68fb75a717379e42"}, {"url": "https://git.kernel.org/stable/c/f7826bc0b39928a4a22f6b815dd9940b22a63503"}, {"url": "https://git.kernel.org/stable/c/710a4ce5d7afd9fe082c75dec282ab4a11c0fe71"}, {"url": "https://git.kernel.org/stable/c/c8369a6d62f5abde9cbd4b62c45bf4b996be2468"}, {"url": "https://git.kernel.org/stable/c/dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f"}, {"url": "https://git.kernel.org/stable/c/9532501e0f1b200ea80baa0e33e0b06da10bb271"}, {"url": "https://git.kernel.org/stable/c/31d00156e50ecad37f2cb6cbf04aaa9a260505ef"}], "title": "crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:24.515362Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:06:12.864Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:24.515362Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:14:25.102Z"}}], "cna": {"title": "crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable AF_ALG skcipher/AEAD path is reached through local socket syscalls such as socket, bind, accept, sendmsg/sendmmsg, and recvmsg. It is not reachable directly from remote network input.\nAC:L - An attacker controls the AF_ALG socket state, TX scatterlist layout, and recv length needed to end processing on an SG boundary and trigger the zero-length reassignment. No race or external timing condition is required.\nPR:L - Creating and using PF_ALG sockets for userspace crypto does not require real root or administrative capabilities. A basic unprivileged local user can reach the affected code.\nUI:N - Exploitation only requires attacker-issued syscalls on the attacker's own AF_ALG socket. No victim action is needed.\nS:U - The corruption occurs inside the kernel and impacts the same kernel security authority. This is standard local kernel attack surface rather than a VM or hardware boundary escape.\nC:H - The bug is kernel heap memory corruption immediately past an allocated scatterlist object. Following the higher-severity rule, this can plausibly be leveraged for kernel memory disclosure.\nI:H - The pre-fix code writes a scatterlist entry past the allocated destination array via sg_set_page. This is an out-of-bounds kernel heap write and can plausibly support privilege escalation or control-flow/object corruption.\nA:H - The issue is directly observed as a KASAN slab-out-of-bounds crash in af_alg_pull_tsgl from recvmsg. Repeated triggering can crash or destabilize the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e", "versionType": "git"}, {"status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "2b781d1d4f933990318bcc5c68fb75a717379e42", "versionType": "git"}, {"status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "f7826bc0b39928a4a22f6b815dd9940b22a63503", "versionType": "git"}, {"status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "710a4ce5d7afd9fe082c75dec282ab4a11c0fe71", "versionType": "git"}, {"status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "c8369a6d62f5abde9cbd4b62c45bf4b996be2468", "versionType": "git"}, {"status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f", "versionType": "git"}, {"status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "9532501e0f1b200ea80baa0e33e0b06da10bb271", "versionType": "git"}, {"status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "lessThan": "31d00156e50ecad37f2cb6cbf04aaa9a260505ef", "versionType": "git"}], "programFiles": ["crypto/af_alg.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.14"}, {"status": "unaffected", "version": "0", "lessThan": "4.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.254", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.204", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.170", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.137", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.85", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["crypto/af_alg.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e"}, {"url": "https://git.kernel.org/stable/c/2b781d1d4f933990318bcc5c68fb75a717379e42"}, {"url": "https://git.kernel.org/stable/c/f7826bc0b39928a4a22f6b815dd9940b22a63503"}, {"url": "https://git.kernel.org/stable/c/710a4ce5d7afd9fe082c75dec282ab4a11c0fe71"}, {"url": "https://git.kernel.org/stable/c/c8369a6d62f5abde9cbd4b62c45bf4b996be2468"}, {"url": "https://git.kernel.org/stable/c/dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f"}, {"url": "https://git.kernel.org/stable/c/9532501e0f1b200ea80baa0e33e0b06da10bb271"}, {"url": "https://git.kernel.org/stable/c/31d00156e50ecad37f2cb6cbf04aaa9a260505ef"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl\n\nWhen page reassignment was added to af_alg_pull_tsgl the original\nloop wasn't updated so it may try to reassign one more page than\nnecessary.\n\nAdd the check to the reassignment so that this does not happen.\n\nAlso update the comment which still refers to the obsolete offset\nargument."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.254", "versionStartIncluding": "4.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.204", "versionStartIncluding": "4.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.170", "versionStartIncluding": "4.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.137", "versionStartIncluding": "4.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.85", "versionStartIncluding": "4.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.24", "versionStartIncluding": "4.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.14", "versionStartIncluding": "4.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:48.958Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43078", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:06:12.864Z", "dateReserved": "2026-05-01T14:12:55.983Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-06T07:40:15.092Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["crypto/af_alg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e", "status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "versionType": "git"}, {"lessThan": "2b781d1d4f933990318bcc5c68fb75a717379e42", "status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "versionType": "git"}, {"lessThan": "f7826bc0b39928a4a22f6b815dd9940b22a63503", "status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "versionType": "git"}, {"lessThan": "710a4ce5d7afd9fe082c75dec282ab4a11c0fe71", "status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "versionType": "git"}, {"lessThan": "c8369a6d62f5abde9cbd4b62c45bf4b996be2468", "status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "versionType": "git"}, {"lessThan": "dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f", "status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "versionType": "git"}, {"lessThan": "9532501e0f1b200ea80baa0e33e0b06da10bb271", "status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "versionType": "git"}, {"lessThan": "31d00156e50ecad37f2cb6cbf04aaa9a260505ef", "status": "affected", "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["crypto/af_alg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.14"}, {"lessThan": "4.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.254", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.204", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.170", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.137", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.85", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E49F4532-8422-46F7-B2E8-96E820919D16", "versionEndExcluding": "5.10.254", "versionStartIncluding": "4.14.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA800016-0012-4E3F-A528-2A7F378A0A4A", "versionEndExcluding": "5.15.204", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6653854-B188-42DD-B8C5-0143F1956AB1", "versionEndExcluding": "6.1.170", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3CA3EF52-168A-4348-8F5F-356C9EB69261", "versionEndExcluding": "6.6.137", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F17D292D-A9B5-4DC7-8002-51AB95335606", "versionEndExcluding": "6.12.85", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*", "matchCriteriaId": "7875AA30-1F6F-470C-A52D-ECBD6663CEC5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl\n\nWhen page reassignment was added to af_alg_pull_tsgl the original\nloop wasn't updated so it may try to reassign one more page than\nnecessary.\n\nAdd the check to the reassignment so that this does not happen.\n\nAlso update the comment which still refers to the obsolete offset\nargument."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: af_alg - Correcci\u00f3n de desbordamiento de reasignaci\u00f3n de p\u00e1gina en af_alg_pull_tsgl\n\nCuando se a\u00f1adi\u00f3 la reasignaci\u00f3n de p\u00e1gina a af_alg_pull_tsgl, el bucle original no se actualiz\u00f3, por lo que podr\u00eda intentar reasignar una p\u00e1gina m\u00e1s de lo necesario.\n\nA\u00f1adir la comprobaci\u00f3n a la reasignaci\u00f3n para que esto no ocurra.\n\nTambi\u00e9n actualizar el comentario que todav\u00eda hace referencia al argumento de desplazamiento obsoleto."}], "id": "CVE-2026-43078", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43078", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:14:24.515362Z", "version": "2.0.3"}}]}, "published": "2026-05-06T10:16:20.853", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2b781d1d4f933990318bcc5c68fb75a717379e42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/31d00156e50ecad37f2cb6cbf04aaa9a260505ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/710a4ce5d7afd9fe082c75dec282ab4a11c0fe71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9532501e0f1b200ea80baa0e33e0b06da10bb271"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c8369a6d62f5abde9cbd4b62c45bf4b996be2468"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f7826bc0b39928a4a22f6b815dd9940b22a63503"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl", "id": "2467023", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467023"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel. Specifically, within the `crypto: af_alg` component, a page reassignment overflow could occur in the `af_alg_pull_tsgl` function. This vulnerability arises because the original loop was not updated, potentially allowing it to reassign one more page than necessary. This could lead to unexpected system behavior or a denial of service (DoS)."], "name": "CVE-2026-43078", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43078\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43078\nhttps://lore.kernel.org/linux-cve-announce/2026050613-CVE-2026-43078-dcf9@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e870456d8e7c8d57c059ea479b5aadbb55ff4c3a,fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e870456d8e7c8d57c059ea479b5aadbb55ff4c3a,2b781d1d4f933990318bcc5c68fb75a717379e42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e870456d8e7c8d57c059 ea479b5aadbb55ff4c3a,f7826bc0b39928a4a22f6b815dd9940b22a63503)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e870456d8e7c8d57c059ea479b5aadbb55ff4c3a,710a4ce5d7afd9fe082c75dec282ab4a11c0fe71)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e870456d8e7c8d57c059ea479b5aadbb55ff4c3a,c8369a6d62f5abde9cbd4b62c45bf4b996be2468)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e870456d8e7c8d57c059ea479b5aadbb55ff4c3a,dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e870456d8e7c8d57c059ea479b5aadbb55ff4c3a,9532501e0f1b200ea80baa0e33e0b06da10bb271)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e870456d8e7c8d57c059ea479b5aadbb55ff4c3a,31d00156e50ecad37f2cb6cbf04aaa9a260505ef)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.254,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.204,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.170,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.137,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.85,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T11:30:26.608313+00:00", "updated": "2026-05-08T19:45:15.213664+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}