Cryptodev Linux CVE-2026-28529

Attacker must have low-privilege local user access to a Linux system running cryptodev-linux version 1.14 or prior with the /dev/crypto device driver loaded and accessible. No victim interaction required.

This vulnerability represents a critical real-world risk despite the absence of a numerical CVSS score in the provided data. The exploit scenario is highly favorable to attackers: the attack vector is local (requiring access to /dev/crypto), the attack complexity is low (the vulnerability can be triggered through controlled page manipulation), and the privilege level required is user-level access to the device file. The availability of publicly disclosed proof-of-concept exploits on GitHub (gist.github.com/n4sm/0fd2479e0c23e0fa2f192cd8fda45750) and detailed technical writeups (nasm.re) significantly accelerates exploitation risk. Use-after-free vulnerabilities are consistently automatable and lead to arbitrary code execution, placing this squarely in the technical impact category of complete system compromise. From an SSVC perspective, exploitation is demonstrated (public POC exists), the attack is automatable, and the technical impact is total system compromise—all factors pointing to immediate remediation priority. The primary limiting factor is that exploitation requires local access; systems restricting user access to /dev/crypto or running kernel versions with the patch mitigate this significantly.

An unprivileged local attacker with standard user account access to a system running cryptodev-linux 1.14 can open the /dev/crypto device and craft a sequence of cryptographic operations that manipulate page reference counts in the get_userbuf function. By repeatedly decrementing reference counts on pages under their control, the attacker triggers a use-after-free condition, allowing them to overwrite kernel memory and ultimately execute arbitrary code with root privileges. A publicly available proof-of-concept exploit (referenced at https://nasm.re/posts/cryptodev-linux-vuln/ and https://gist.github.com/n4sm/0fd2479e0c23e0fa2f192cd8fda45750) demonstrates this attack path, making exploitation straightforward for attackers with local access.