CVE-2026-28529

Name of the Vulnerable Software and Affected Versions cryptodev-linux versions prior to 1.15

Description A page reference handling flaw exists in the get userbuf() function of the /dev/crypto device driver. This issue allows local users to trigger use-after-free conditions, which occurs when a program continues to use a pointer after it has been freed. Attackers with access to the /dev/crypto interface can repeatedly decrement reference counts of controlled pages to achieve local privilege escalation.

Recommendations Update to a version newer than 1.14. Restrict access to the /dev/crypto interface to minimize the risk of exploitation.