Vulnerability in Linux Kernel Affecting Crypto Implementations

CVE-2025-71131

What is CVE-2025-71131?

A vulnerability in the Linux kernel's crypto subsystem could lead to improper memory management when using the seqiv mechanism. Specifically, the issue arises after calling the crypto_aead_encrypt function, where the underlying request might be freed through asynchronous completion. This results in dereferencing an invalid memory reference by attempting to access req->iv. The resolution involves creating a new variable, unaligned_info, to avoid utilizing req->iv post-encryption, thereby improving stability and security of affected systems.

References