Linux Kernel EUVD-2026-32409

The vulnerability resides in the Linux kernel's AF_ALG (Algorithm) socket interface, specifically the algif_aead module (crypto/algif_aead.c), which exposes kernel cryptographic primitives to userspace via socket operations. AEAD (Authenticated Encryption with Associated Data) algorithms - such as AES-GCM and ChaCha20-Poly1305 - depend on a unique Initialization Vector (IV) per operation to ensure ciphertext uniqueness and integrity. When applications use AIO (Asynchronous I/O) mode with AEAD via AF_ALG, multiple requests can be in-flight simultaneously. The vulnerable code path kept the IV in a single socket-wide buffer rather than copying it into per-request storage at submission time, creating a classic time-of-check/time-of-use race (conceptually CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization, though no CWE is officially assigned). Any subsequent socket write that modifies the shared IV before the original async operation completes will corrupt that in-flight request's cryptographic context. Affected products are confirmed by CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple stable series, introduced by commit d887c52d6ae43aeebd249b5f2f1333e60236aa60.