Linux Kernel Vulnerability in AF_ALG Implementation by The Linux Foundation

CVE-2026-31677

What is CVE-2026-31677?

A vulnerability in the Linux kernel's AF_ALG (Asynchronous Functionality Algorithm) implementation allows inadequate management of receive buffer space during data extraction processes. Specifically, the function af_alg_get_rsgl() did not properly limit RX scatterlist extractions in accordance with the available receive buffer budget. This oversight could lead to a mismatch between the accounting of data received and the actual data attached to incoming requests. As a remedy, when the skcipher cannot accommodate sufficient RX space for at least one chunk of incoming data, the recvmsg call is now explicitly rejected—preventing erroneous handling of requests and ensuring proper resource utilization.

References