Linux Kernel CVE-2026-74578

Exploitation requires a local user account on the target system - no network access is needed. The attacker must be able to open an AF_ALG socket of type SOCK_SEQPACKET with ALG_TYPE_SKCIPHER; on most Linux distributions, this is accessible to unprivileged users with user namespace support enabled (the default on Ubuntu, Fedora, Arch). The vulnerable code path is reachable only through the AIO branch of skcipher_recvmsg(), meaning the target application or the attacker's own process must invoke io_submit() on an AF_ALG file descriptor rather than the synchronous recvmsg() path. The race is exploitable specifically against symmetric ciphers with statesize == 0, which includes CBC and CTR mode - these are the modes where IV chaining via req->iv writeback is used. Successful exploitation requires timing two concurrent socket operations (AIO io_submit and sendmsg ALG_SET_IV) within the same race window, which makes it probabilistic rather than deterministic - the CVE description documents a 2296/200000 success rate on 6.6.y before the fix. Exploitation is not possible against ciphers that maintain internal state (statesize != 0) or against synchronous recvmsg() callers. The race is not remotely triggerable and cannot be exploited from a network context.

The NVD-assigned CVSS of 7.1 with AV:L/AC:L/PR:L captures the local privilege requirement but AC:L arguably understates the attack complexity - this is a timing-sensitive race condition between concurrent socket operations, which in practice makes reliable exploitation harder than a deterministic flaw. An independent assessment of AC:H is more accurate. EPSS of 0.19% at the 9th percentile confirms low automated exploitation probability, consistent with the local-only vector and race-timing dependency. The vulnerability is not listed in the CISA KEV catalog and no public exploit code exists. Despite the low EPSS, the C:H/I:H impact is concrete and well-demonstrated: the CVE description documents that attacker IV injection dropped from 2296/200000 to 0/200000 after the fix on 6.6.y, confirming the attack is reproducible even if not trivially reliable. In practice, the real-world attack surface is narrow - AF_ALG AIO is rarely used by production userspace crypto libraries - meaning even a mid-sized municipal IT team in gdynia running standard glibc/OpenSSL stacks is unlikely to be exposed unless running custom kernel crypto offloading code. The combination of low EPSS, local-only access, and narrow AF_ALG AIO usage makes this a moderate operational priority, but the high cryptographic impact justifies patching at the next scheduled kernel maintenance window.

A local unprivileged user opens an AF_ALG SOCK_SEQPACKET socket configured for CTR mode and submits an AIO decryption request via io_submit(), which releases the socket lock while the request is in-flight and referencing the shared ctx->iv buffer. Concurrently, a second thread from the same process issues sendmsg(ALG_SET_IV) to overwrite the shared IV, causing the in-flight cipher operation to execute under the injected IV. By choosing the injected IV to match a known previous IV, the attacker induces keystream reuse and can XOR the ciphertext outputs to recover the plaintext of the victim's concurrent operation. No public exploit code has been identified at time of analysis.