Which versions of Cryptodev Linux are affected by EUVD-2026-15408?

CVE-2026-28529 presents significant security risk, a use-after-free vulnerability rated CVSS 8.5.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-15408?

Yes, a public proof-of-concept exploit is available for EUVD-2026-15408. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-15408?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Cryptodev Linux EUVD-2026-15408

Q: What is the CVSS score of EUVD-2026-15408?

EUVD-2026-15408 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-28529 HIGH

Use After Free (CWE-416)

2026-03-25 VulnCheck

GHSA-vgx9-cpq5-rx9p

Privilege Escalation Use After Free Memory Corruption Cryptodev Linux

8.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 25, 2026 - 15:41 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 13:30 euvd

EUVD-2026-15408

Analysis Generated

Mar 25, 2026 - 13:30 vuln.today

Patch released

Mar 25, 2026 - 13:30 nvd

Patch available

CVE Published

Mar 25, 2026 - 13:00 nvd

HIGH 8.5

DescriptionCVE.org

cryptodev-linux version 1.14 and prior contain a page reference handling flaw in the get_userbuf function of the /dev/crypto device driver that allows local users to trigger use-after-free conditions. Attackers with access to the /dev/crypto interface can repeatedly decrement reference counts of controlled pages to achieve local privilege escalation.

AnalysisAI

cryptodev-linux 1.14 and earlier suffer from a use-after-free vulnerability in the /dev/crypto device driver that enables local privilege escalation through reference count manipulation. Attackers with local access can exploit this memory corruption flaw to gain elevated privileges on affected systems. Public exploit code exists for this vulnerability.

Technical ContextAI

The cryptodev-linux project provides a Linux kernel device driver (/dev/crypto) that exposes cryptographic hardware acceleration and software implementations to userspace applications via the /dev/crypto character device interface. The vulnerability resides in the get_userbuf function, which is responsible for managing page reference counts when handling user-supplied buffers for cryptographic operations. The root cause is classified under CWE-416 (Use After Free), a memory safety defect where the driver fails to properly track page reference counts, permitting attackers to decrement reference counts on controlled pages multiple times. This results in premature page deallocation while the kernel still holds references to those pages, creating a use-after-free condition exploitable for memory corruption and privilege escalation. The affected product is identified by CPE string cpe:2.3:a:cryptodev-linux:cryptodev-linux:*:*:*:*:*:*:*:*, covering all versions up to and including 1.14.

RemediationAI

Immediately upgrade cryptodev-linux to a version newer than 1.14 that includes the patch from PR #104 (https://github.com/cryptodev-linux/cryptodev-linux/pull/104). If immediate patching is not feasible, restrict access to the /dev/crypto device by removing user permissions on the device file (chmod 600 /dev/crypto) and ensuring only privileged system services that require cryptographic acceleration can access it. Audit system configurations to identify any unnecessary exposure of /dev/crypto to untrusted local users, and consider disabling the cryptodev-linux module entirely if hardware crypto acceleration is not required. Apply the vendor patch as soon as possible, as no effective workaround fully eliminates the exploitation risk once the device is exposed.