The Linux kernel's mpi_read_raw_from_sgl() function had an integer underflow bug triggered by subtracting the number of leading zero bytes from an unsigned byte count parameter 'nbytes'. This underflow occurs when the scatterlist length exceeds 'nbytes' and the first 'nbytes + 1' bytes of the scatterlist are zero, causing the function's loop to count more zeroes than 'nbytes' and underflow the subtraction. The bug was introduced in commit 2d4d1eea540b but was not initially exploitable because callers passed scatterlists equal in length to 'nbytes'. Later, commit 63ba4d67594a changed usage patterns allowing the underflow to be triggered during a KEYCTL_PKEY_ENCRYPT system call with a larger output length than input length and zero-filled input buffers. This leads to an infinite loop in the kernel, causing a denial of service via soft lockups. The vulnerability is tracked as CVE-2026-43492 and has been fixed.

The vulnerability causes a denial of service condition in the Linux kernel by triggering an infinite loop that results in kernel soft lockups. There is no impact on confidentiality or integrity. The attack requires local privileges with low complexity and no user interaction, but it does not lead to code execution or data compromise.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include the patch for CVE-2026-43492. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the Linux kernel vendor advisory for the exact fixed versions and update accordingly.