CVE-2025-71113

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel's crypto subsystem contains an issue where memory allocated via sock kmalloc() was not zero-initialized. This affected several crypto user API contexts and requests, relying on callers to explicitly set fields. The lack of initialization led to the use of uninitialized data in error paths and potential issues with newly added fields, such as the inflight variable introduced in commit 67b164a871af. Specifically, the af alg alloc areq() function incorrectly returned -EBUSY due to the inflight variable containing garbage values. Zero-initializing the allocated memory ensures all fields start in a known state, preventing random failures caused by uninitialized data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.