Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-71131

crypto: seqiv - Do not use req->iv after crypto_aead_encrypt

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid. Instead of checking req->iv against info, create a new variable unaligned_info and use it for that purpose instead.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 0a270321dbf948963aeb0e8382fe17d2c2eb3771 · fixed in 18202537856e0fae079fed2c9308780bcff2bb9d; From 0a270321dbf948963aeb0e8382fe17d2c2eb3771 · fixed in baf0e2d1e03ddb04781dfe7f22a654d3611f69b2; From 0a270321dbf948963aeb0e8382fe17d2c2eb3771 · fixed in 50f196d2bbaee4ab2494bb1b0d294deba292951a; From 0a270321dbf948963aeb0e8382fe17d2c2eb3771 · fixed in 0279978adec6f1296af66b642cce641c6580be46; From 0a270321dbf948963aeb0e8382fe17d2c2eb3771 · fixed in ccbb96434d88e32358894c879457b33f7508e798; From 0a270321dbf948963aeb0e8382fe17d2c2eb3771 · fixed in 5476f7f8a311236604b78fcc5b2a63b3a61b0169; From 0a270321dbf948963aeb0e8382fe17d2c2eb3771 · fixed in 50fdb78b7c0bcc550910ef69c0984e751cac72fa

  • Linux Linux

    2.6.25

  • KernelLinux

    From 2.6.25 · fixed in 5.10.248; From 5.11.0 · fixed in 5.15.198; From 5.16.0 · fixed in 6.1.160; From 6.2.0 · fixed in 6.6.120; From 6.7.0 · fixed in 6.12.64; From 6.13.0 · fixed in 6.18.4

References 7

git.kernel.org