Description

In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_authenc_esn_decrypt() can advance past the end of the destination scatterlist and trigger a NULL pointer dereference in scatterwalk_map_and_copy(), leading to a kernel panic (DoS). Add a minimum AAD length check to fail fast on invalid inputs.

INFO

Published Date :

2026-02-04T16:07:42.860Z

Last Modified :

2026-02-09T08:37:58.639Z

Source :

Linux
AFFECTED PRODUCTS

The following products are affected by CVE-2026-23060 vulnerability.

Vendors Products
Linux
  • Linux Kernel
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-23060.

URL Resource
https://git.kernel.org/stable/c/161bdc90fce25bd9890adc67fa1c8563a7acbf40 cve-icon cve-icon
https://git.kernel.org/stable/c/2397e9264676be7794f8f7f1e9763d90bd3c7335 cve-icon cve-icon
https://git.kernel.org/stable/c/767e8349f7e929b7dd95c08f0b4cb353459b365e cve-icon cve-icon
https://git.kernel.org/stable/c/9532ff0d0e90ff78a214299f594ab9bac81defe4 cve-icon cve-icon
https://git.kernel.org/stable/c/b0a9609283a5c852addb513dafa655c61eebc1ef cve-icon cve-icon
https://git.kernel.org/stable/c/df22c9a65e9a9daa368a72fed596af9d7d5876bb cve-icon cve-icon
https://git.kernel.org/stable/c/fee86edf5803f1d1f19e3b4f2dacac241bddfa48 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2026020414-CVE-2026-23060-6a41@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-23060 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-23060 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact