NULL Pointer Dereference in Linux Kernel's AF_ALG Interface

CVE-2026-43043

What is CVE-2026-43043?

A vulnerability in the Linux kernel's AF_ALG interface can lead to a NULL pointer dereference when using a Scatter/Gather List (SGL). This occurs when a subsequent sendmsg() operation chains a new af_alg_tsgl structure without appropriately clearing the end marker of the previous SGL. If the previous SGL reaches its maximum entries, the last entry remains marked as the end. This mismanagement can cause the crypto scatterwalk process to prematurely terminate, ultimately resulting in a kernel panic during dereference. The issue has been addressed in recent kernel updates by ensuring the end marker is explicitly unmarked before chaining.

References