Synchronous Processing Vulnerability in Linux Kernel Affecting Crypto Algorithms

CVE-2026-74578

What is CVE-2026-74578?

A vulnerability in the Linux kernel's crypto subsystem allows an attacker to manipulate the Initialization Vector (IV) used in encryption operations. This occurs during the asynchronous handling of socket requests, where the context IV can be overwritten by concurrent operations. When unprivileged users exploit this flaw, it may lead to IV or keystream reuse, enabling them to recover plaintext data from ongoing encryption processes. The issue arises from a lack of proper synchronization, which allows attackers to inject controlled IVs, compromising the security and confidentiality of encrypted data. The recent patch addresses this by enforcing synchronous processing for affected algorithms, effectively mitigating the risks associated with this vulnerability.

References