CVE-2026-43492 is an integer underflow vulnerability in the Linux kernel's lib/crypto mpi_read_raw_from_sgl() function. The underflow occurs when subtracting the count of leading zero bytes (lzeros) from an unsigned nbytes parameter if the scatterlist length exceeds nbytes and the first nbytes+1 bytes are zero. This causes an infinite loop in the kernel, resulting in a denial of service via soft lockup. The vulnerability became exploitable after a commit changed the crypto interface to use scatterlists in asymmetric key operations, allowing the underflow condition to be met during a KEYCTL_PKEY_ENCRYPT syscall with a larger output length than input length and zero-filled input buffer. The issue has been fixed in the kernel.

The vulnerability causes a denial of service by making the Linux kernel enter an infinite loop, leading to soft lockup crashes. There is no impact on confidentiality or integrity. The attack requires local privileges with low complexity and no user interaction. The CVSS 3.1 base score is 5.5 (medium severity).

A fix for this integer underflow vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this fix. Since no vendor advisory or patch links are provided here, check the Linux kernel mailing lists or official repositories for the relevant patch and update guidance. No additional mitigations are specified or required beyond applying the fix.