Skip to main content

Linux Kernel CVE-2026-43493

| EUVDEUVD-2026-30884 CRITICAL
Detection of Error Condition Without Action (CWE-390)
2026-05-19 Linux GHSA-v9g7-8cgp-9v29
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain access to crypto submission interface (AF_ALG or in-kernel consumer)
  2. Delivery
    Submit AEAD request with MAY_BACKLOG flag
  3. Exploit
    Trigger EBUSY/EINPROGRESS mishandling in pcrypt
  4. Execution
    Corrupt crypto request state tracking
  5. Impact
    Cause kernel instability or undefined crypto behavior

Vulnerability Assessment

Weakness
CWE
CWE-390
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error detection with action
Exploitation Conditions

Exploitation requires a kernel build with the pcrypt module loaded and an in-kernel or userspace consumer that submits cryptographic requests with the CRYPTO_TFM_REQ_MAY_BACKLOG flag set - typically AF_ALG userspace crypto socket users, IPsec/ESP processing, or asynchronous AEAD consumers configured to use parallel crypto via padata. The attacker must reach one of these crypto submission interfaces, which in practice usually means local access or a configured network service (such as an IPsec endpoint) that funnels untrusted input into a pcrypt-backed transform. Limiting factors: systems that do not load the pcrypt module, single-CPU systems where parallel crypto offers no benefit, and configurations that do not expose AF_ALG to unprivileged users are not reachable; despite the CVSS AV:N rating, no remote network-exposed trigger has been described in the public advisory.
Impact

There is a significant discrepancy between the CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and other intelligence signals that warrants explicit caution. The CVSS vector indicates remote, unauthenticated, low-complexity attack with full CIA impact, yet pcrypt is a kernel-internal parallel crypto facade not directly exposed over the network - exploitation would require an attacker-controllable code path that submits MAY_BACKLOG crypto requests, which is not characteristic of an AV:N scenario. EPSS at 0.02% (5th percentile) and absence from CISA KEV strongly contradict the CVSS 9.8 framing, suggesting this is a high-CVSS-but-low-real-risk issue typical of bulk Linux kernel CNAs that auto-assign elevated scores to crypto fixes. The vendor description characterizes this as a resolved correctness fix rather than a security exploit, and the 'Information Disclosure' tag is not substantiated by the description text. Conflicting signal: CVSS network vector vs. kernel-internal nature of pcrypt - verify with distribution security trackers (e.g., Red Hat, SUSE, Ubuntu) before treating as a critical priority.
Exploit ScenarioDerived

An attacker with the ability to submit cryptographic requests through a kernel interface that uses pcrypt (for example via AF_ALG sockets, IPsec, or in-kernel consumers configured to use parallel crypto) could craft a workload that triggers the MAY_BACKLOG/EBUSY/EINPROGRESS mishandling, potentially destabilizing the crypto request state machine. There is no public exploit identified at time of analysis, and no demonstrated path to code execution or information disclosure has been published. Realistic exploitation would require local access to crypto-submitting interfaces despite the CVSS network vector framing.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Improper handling of MAY_BACKLOG requests in the Linux kernel's pcrypt (parallel crypto) module can cause incorrect processing of EBUSY return codes and EINPROGRESS notifications, potentially leading to instability or undefined behavior in cryptographic operations. The issue affects Linux kernel versions dating back to 2.6.34 and has been resolved upstream across multiple stable branches including 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc1. There is no public exploit identified at time of analysis and EPSS scoring (0.02%, 5th percentile) suggests very low real-world exploitation likelihood despite the CVSS 9.8 rating.

RemediationAI

Vendor-released patches are available in Linux stable kernels 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc1; upgrade to the appropriate fixed version for your maintained branch by consulting the commits at https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2, https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276, https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67, https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a, and https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110, and pick up the corresponding distribution kernel package once your vendor (Red Hat, SUSE, Ubuntu, Debian, etc.) ships the backport. If immediate patching is not feasible and you do not require parallelized crypto, unloading or blacklisting the pcrypt module (modprobe -r pcrypt; add 'blacklist pcrypt' under /etc/modprobe.d/) removes the affected code path at the cost of losing parallel AEAD crypto acceleration, which may reduce IPsec or dm-crypt throughput on multi-core systems. Track distribution advisories via https://nvd.nist.gov/vuln/detail/CVE-2026-43493 for backport availability.

Affected VersionsENISA

Linux 2.6.34
Linux patch: 6.12.86
Linux patch: 6.18.27
Linux 5a1436beec5744029f3ac90b6fe71a698dcd6155 <eb34e243df57e32f4c08fa191f3602ea19076276
Linux patch: 7.1-rc1
Linux 5a1436beec5744029f3ac90b6fe71a698dcd6155 <9f1cbca178c03188e201ed175251372149bb25f2
Linux patch: 0
Linux patch: 6.6.140
Linux 5a1436beec5744029f3ac90b6fe71a698dcd6155 <46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a
Linux 5a1436beec5744029f3ac90b6fe71a698dcd6155 <915b692e6cb723aac658c25eb82c58fd81235110
Linux patch: 7.0.4
Linux 5a1436beec5744029f3ac90b6fe71a698dcd6155 <77d55bc8675ee851ed639dc9be77325a8024cf67

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the pcrypt (parallel crypto) module of the Linux kernel's crypto subsystem, which parallelizes cryptographic operations across multiple CPUs using the padata framework. The defect specifically involves the handling of requests submitted with the CRYPTO_TFM_REQ_MAY_BACKLOG flag, which permits requests to be queued when the crypto engine is busy rather than rejected outright. Such backlogged requests can legitimately return EBUSY, but the prior code path did not properly distinguish this from error states and failed to filter out asynchronous EINPROGRESS completion notifications, leading to incorrect state tracking in the crypto request lifecycle. Affected products per CPE are Linux kernel distributions identified by cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. No CWE has been assigned by NVD, though the issue is functionally a state/error-handling defect in a kernel crypto component.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL
Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
May 20, 2026 - 17:22 NVD
9.8 (CRITICAL)
Patch available
May 19, 2026 - 12:02 EUVD
CVE Published
May 19, 2026 - 10:44 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: pcrypt - Fix handling of MAY_BACKLOG requests

MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

Executive ViewAI

Why It Matters

The Linux kernel contains a critical vulnerability (CVSS 9.8) in its cryptographic processing module affecting versions dating back to 2006. No public exploit has been identified at time of analysis; independent risk assessment indicates near-zero real-world exploitation likelihood (EPSS 0.02%, 5th percentile). Organizations should schedule kernel updates within 7 days as routine maintenance, with elevated priority for systems handling sensitive cryptographic operations.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is impractical, disable the pcrypt kernel module (CONFIG_CRYPTO_PCRYPT) on systems that do not require parallel cryptographic acceleration, eliminating the vulnerability from systems where the module is not used.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
1
1 sources
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-390 – Detection of Error Condition Without Action

View all
CVE-2025-26465 MEDIUM
6.8
CVE-2021-40391 CRITICAL POC
9.8
CVE-2019-5051 HIGH POC
8.8
CVE-2024-12086 MEDIUM POC
6.8
CVE-2026-111823 CRITICAL
9.8
CVE-2026-52989 CRITICAL
9.8
CVE-2026-104480 CRITICAL
9.4
CVE-2026-76642 HIGH
8.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43493 ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/364622 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/1d7f07df450bac3301938fbc4251f2611be4084e REF https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a REF https://git.kernel.org/stable/c/76641449b28979ebd6c02e9598367e119e385236 REF https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67 REF https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110 REF https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2 REF https://git.kernel.org/stable/c/ae7e95638d956d556d74b9abb9e780d3bd3dcd9e REF https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy