Skip to main content

Linux Kernel CVE-2026-68125

| EUVDEUVD-2026-55506 HIGH
2026-08-10 Linux GHSA-pj3j-hrq9-5j4f
Information Disclosure Linux Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Adjacent radio vector required; any unauthenticated 802.15.4 peer triggers the flaw with low complexity; full kernel-level C/I/A impact confirmed by KASAN.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:23 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:58 cve.org
HIGH 8.8
CVE Published
Aug 10, 2026 - 11:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mac802154: llsec: reject frames shorter than the authentication tag

llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as

assoclen += datalen - authlen;

where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame whose payload is shorter than the tag makes datalen - authlen negative; assoclen is then passed to aead_request_set_ad() as an unsigned value close to 4 GiB, so crypto_aead_decrypt() walks far off the end of the scatterlist that only spans the real frame.

The frame is fully attacker-controlled and reaches this path from any IEEE 802.15.4 peer in radio range. Reject frames whose payload is shorter than the authentication tag before the subtraction.

Dynamically reproduced on a KASAN kernel as a general-protection-fault in the AEAD scatterwalk, and the fix confirmed.

AnalysisAI

Integer underflow in the Linux kernel mac802154 link-layer security subsystem allows any unauthenticated IEEE 802.15.4 peer within radio range to corrupt kernel memory by transmitting a crafted secured frame with a payload shorter than the AEAD authentication tag. The flaw in llsec_do_decrypt_auth() causes an unsigned integer wraparound that passes an approximately 4 GiB associated-data length to the crypto subsystem, driving the AEAD scatterwalk far beyond the actual frame buffer and producing a general-protection-fault or exploitable kernel memory corruption. No public exploit is identified at time of analysis and EPSS is very low at 0.21%, but full kernel-level impact (C:H/I:H/A:H) is rated given confirmed KASAN reproduction; real-world exposure is constrained to embedded Linux deployments with 802.15.4 hardware and LLSEC explicitly configured.

Technical ContextAI

The vulnerable component is llsec_do_decrypt_auth() in net/mac802154/llsec.c, the IEEE 802.15.4 mac-layer link-layer security (llsec) implementation in the Linux kernel. The root cause is an integer underflow (mapping to CWE-191 and CWE-125, though NVD lists CWE as N/A): the expression assoclen += datalen - authlen performs unsigned integer subtraction without first verifying that datalen is at least as large as authlen (4, 8, or 16 bytes depending on the configured security suite). When datalen < authlen, the subtraction wraps to a value near UINT_MAX (~4,294,967,295), and this inflated assoclen is passed to aead_request_set_ad() and then crypto_aead_decrypt(). The AEAD scatterwalk iterates over memory well beyond the scatterlist that spans only the actual received frame, confirmed by KASAN as a general-protection-fault. Affected CPE is cpe:2.3:a:linux:linux per NVD, with the vulnerable code path introduced at commit 4c14a2fb5d143e4ed94143be2b8c1961b47df9af (approximately Linux 3.16 per EUVD data). IEEE 802.15.4 is used in 6LoWPAN, industrial IoT, and Zigbee-adjacent stacks; LLSEC is an optional security layer that is not enabled by default.

RemediationAI

Vendor-released patch is available across all active stable branches. Upgrade to Linux 7.1.6, 6.12.101, 6.6.148, or 6.18.42 as appropriate for your kernel series; fix commits are available at kernel.org stable trees (see references above). Linux distribution vendors (Debian, Ubuntu, RHEL, SUSE) should be issuing kernel security updates; track their advisories and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-68125. For systems that cannot be immediately patched, two targeted workarounds are available. First, disable LLSEC on the 802.15.4 interface by setting the security level to SEC_LEVEL_NONE via the nl802154 configuration API - note this removes frame authentication and encryption, a meaningful security trade-off in environments relying on LLSEC. Second, take the radio interface offline entirely (ip link set wpan0 down or equivalent) or unload the mac802154 module if 802.15.4 connectivity is not operationally required. Physical shielding or reducing the radio's operating range to trusted-peer-only environments is an additional compensating control for high-security deployments.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68125 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy