CVE-2026-80843

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-80843
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-80843.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-80843
Downstream
Related
Published
2026-09-04T15:54:53Z
Modified
2026-09-15T18:26:50Z
Summary
xfrm: fix xfrm_state_construct() auth-trunc leak
Details

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix xfrm_state_construct() auth-trunc leak

attach_auth_trunc() can allocate x->aalg while leaving x->props.aalgo at zero when the selected auth algorithm has no sadb_alg_id. One real case is cmac(aes).

xfrm_state_construct() then treats !x->props.aalgo as "no auth algorithm attached yet" and calls attach_auth(). That overwrites x->aalg and loses the first allocation. Any later failure or teardown only frees the replacement pointer.

Check whether x->aalg is already attached instead of inferring that state from x->props.aalgo.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80843.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4447bb33f09444920a8f1d89e1540137429351b6
Fixed
958ae9f261319e1cdc44879886bcda2263258cca
Fixed
fb7f3e74789a3c89647f4eb768f6dfaf4a751e72
Fixed
ba0c110c205855b3f1e3130d8c0fdb484d704c8c
Fixed
c8837bbe792257af547fd1c0252553ce13148795
Fixed
71d42da01740ec6557837bebec0bc48cfc3b4c39
Fixed
cf67361e78dca488d6e4df8396a53e6745a3a80e
Fixed
37426395cb90ef217beec8407a14bd82153793d3
Fixed
be19d20e53a239572bb2a28efcc1cd2b069b1ef9
Fixed
c12cbf56320fb633484ee0ca1fb7d68d6b64b213

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-80843.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.33
Fixed
5.10.269
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.220
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.187
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.156
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.108
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.49
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.13
Type
ECOSYSTEM
Events
Introduced
7.2.0
Fixed
7.2.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-80843.json"