CVE-2026-74578

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the algif skcipher component where the AIO/async path in the skcipher recvmsg() function passes the socket-wide ctx->iv directly into the skcipher request. Because the socket lock is dropped after io submit(), a concurrent sendmsg(ALG SET IV) call can overwrite ctx->iv. This allows an unprivileged user to force an in-flight request to run under an attacker-controlled Initialization Vector (IV). In CTR or stream modes, this leads to IV/keystream reuse, enabling the recovery of plaintext from a concurrent operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.