Linux Kernel Vulnerability Related to Async AH Implementation by Linux Foundation

CVE-2026-46193

What is CVE-2026-46193?

A vulnerability has been identified in the Linux Kernel concerning the asynchronous Authentication Header (AH) implementation. This vulnerability arises when the extended sequence number (ESN) feature is enabled, leading to discrepancies in how temporary authentication and integrity check value (ICV) layouts are allocated. The async implementation fails to account for the required high-order ESN bits during certain callback operations, causing incorrect byte comparisons on both IPv4 and IPv6 protocols. This could result in significant packet loss, as observed in practical error reports. Following corrective measures that align the callback handling with the initial setup, the offsets have been fixed, ensuring proper function of the AH parameters and restoring expected connectivity without data loss. This demonstrates the need for robust validation in async processing mechanisms within network operations.

References