CVE-2026-23060

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23060
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23060.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-23060
Downstream
Related
Published
2026-02-04T16:07:42.860Z
Modified
2026-05-07T04:17:01.253728Z
Summary
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
Details

In the Linux kernel, the following vulnerability has been resolved:

crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec

authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, cryptoauthencesndecrypt() can advance past the end of the destination scatterlist and trigger a NULL pointer dereference in scatterwalkmapandcopy(), leading to a kernel panic (DoS).

Add a minimum AAD length check to fail fast on invalid inputs.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23060.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
104880a6b470958ddc30e139c41aa4f6ed3a5234
Fixed
df22c9a65e9a9daa368a72fed596af9d7d5876bb
Fixed
fee86edf5803f1d1f19e3b4f2dacac241bddfa48
Fixed
767e8349f7e929b7dd95c08f0b4cb353459b365e
Fixed
b0a9609283a5c852addb513dafa655c61eebc1ef
Fixed
161bdc90fce25bd9890adc67fa1c8563a7acbf40
Fixed
9532ff0d0e90ff78a214299f594ab9bac81defe4
Fixed
2397e9264676be7794f8f7f1e9763d90bd3c7335

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23060.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.3.0
Fixed
5.10.249
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.199
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.162
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.122
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.68
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.8

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23060.json"