CVE-2026-68125

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mac802154 module where the llsec do decrypt auth() function fails to verify if a frame contains at least the required number of payload bytes before calculating the associated-data length for an AEAD (Authenticated Encryption with Associated Data) request. When a secured frame's payload is shorter than the authentication tag authlen, the calculation assoclen += datalen - authlen results in a negative value. This value is then treated as a large unsigned integer when passed to aead request set ad(), causing crypto aead decrypt() to read beyond the end of the scatterlist. This can be triggered by any IEEE 802.15.4 peer within radio range using an attacker-controlled frame, potentially leading to a general-protection-fault.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.