In the Linux kernel, the following vulnerability has been resolved:
crypto: seqiv - Do not use req->iv after cryptoaeadencrypt
As soon as cryptoaeadencrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid.
Instead of checking req->iv against info, create a new variable unaligned_info and use it for that purpose instead.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71131.json",
"cna_assigner": "Linux"
}