Skip to main content

Linux Kernel EUVDEUVD-2026-38840

| CVE-2026-52972 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-24 Linux GHSA-9qr8-jp95-w4m5
Buffer Overflow Linux Integer Overflow
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.0 HIGH

Local unprivileged user can reach AF_ALG (AV:L, PR:L); reliably triggering and shaping the integer-overflow corruption is non-trivial (AC:H); kernel memory corruption yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Severity Changed
Jul 14, 2026 - 17:07 NVD
HIGH MEDIUM
CVSS changed
Jul 14, 2026 - 17:07 NVD
7.0 (HIGH) 5.5 (MEDIUM)
Analysis Generated
Jun 30, 2026 - 05:29 vuln.today
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.0 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 7.0
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Cap AEAD AD length to 0x80000000

In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data length to 0x80000000.

AnalysisAI

Integer overflow in the Linux kernel's AF_ALG socket interface (crypto/af_alg.c) lets a local user supply an oversized AEAD associated-data length that wraps during TX buffer size arithmetic, corrupting size checks; the fix caps AD length to 0x80000000. Carrying CVSS 7.0 (AV:L/AC:H/PR:L), it affects any kernel exposing the algif AEAD interface and threatens confidentiality, integrity, and availability through resulting memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), consistent with a local-only, high-complexity issue.

Technical ContextAI

The flaw lives in the kernel's AF_ALG / algif crypto user-space API, which lets unprivileged processes drive in-kernel cipher implementations via the AF_ALG socket family (e.g. the algif_aead module for authenticated encryption). When an AEAD request specifies its associated-data (AD) length, the kernel computes the required TX buffer size; an attacker-controlled AD value large enough to overflow this arithmetic bypasses the intended bounds check. This is a classic CWE-190 (Integer Overflow or Wraparound) condition where untrusted length input is used in size math without saturation - the remediation caps AD length at 0x80000000 so the multiplication/addition cannot wrap. The 'Buffer Overflow' tag reflects the downstream memory-corruption potential once the size check is defeated.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 (or later in your series), or apply the upstream stable commits listed at git.kernel.org (e.g. https://git.kernel.org/stable/c/f8a5203596797f394ff3f9aa4005597a92249802 and the sibling commits). For distribution kernels, track and apply the vendor build referenced in the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-52972 and VEX at https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52972.json. Where immediate patching is not possible, the most effective compensating control is to remove attacker reachability to the AF_ALG interface: block loading of the algif_aead/af_alg modules (e.g. modprobe blacklist or 'install af_alg /bin/true') so unprivileged processes cannot open AF_ALG sockets, or restrict the syscall via seccomp/LSM policy for untrusted workloads and containers - the trade-off is that applications relying on the kernel crypto user-space API will lose that functionality. Restricting local/untrusted-user access to affected hosts also reduces exposure given the local-only attack vector.

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

Share

EUVD-2026-38840 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy