VulnerabilityPublished 25 Jul 2026

CVE-2026-64436: Linux kernel · net: af_key: initialize alg_key_len for IPComp states

Source GCVE Database

Authoritative record:CVE-2026-64436· High 7.1

Not known to be exploited · CVSS 7.1 High · fixed in e8417353cbd078d10531ba3928e609c84ab09e6b : patch Linux kernel soon.

Data as of 26 Oct 2026, 12:55 UTC

CVSS 3.1 base score

7.1High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e8417353cbd078d10531ba3928e609c84ab09e6b, d129c3177d7b1138fd5066fcc63a698b3ba415b0, cea34abc94b0a81e3a8b5cfb41cf45af37c2c67e +5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-rcfx-m5g2-2jgr

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 80c9abaabf4283f7cf4a0b3597cd302506635b7f, < e8417353cbd078d10531ba3928e609c84ab09e6b	Fixed in e8417353cbd078d10531ba3928e609c84ab09e6b
LinuxLinux	Affected ≥ 80c9abaabf4283f7cf4a0b3597cd302506635b7f, < d129c3177d7b1138fd5066fcc63a698b3ba415b0	Fixed in d129c3177d7b1138fd5066fcc63a698b3ba415b0
LinuxLinux	Affected ≥ 80c9abaabf4283f7cf4a0b3597cd302506635b7f, < cea34abc94b0a81e3a8b5cfb41cf45af37c2c67e	Fixed in cea34abc94b0a81e3a8b5cfb41cf45af37c2c67e
LinuxLinux	Affected ≥ 80c9abaabf4283f7cf4a0b3597cd302506635b7f, < 273c06b81d2e902b21acc801ae18c8276c8a9b69	Fixed in 273c06b81d2e902b21acc801ae18c8276c8a9b69
LinuxLinux	Affected ≥ 80c9abaabf4283f7cf4a0b3597cd302506635b7f, < 58e82fc3dedb57b1432292504415b224fd2d6acb	Fixed in 58e82fc3dedb57b1432292504415b224fd2d6acb
LinuxLinux	Affected ≥ 80c9abaabf4283f7cf4a0b3597cd302506635b7f, < 6de2a650917bedaaefd65b17cede83c5e2c1dedd	Fixed in 6de2a650917bedaaefd65b17cede83c5e2c1dedd

AI-suggested

A fix is available that initializes the alg_key_len field to zero in the IPComp compression algorithm structure, preventing uninitialized memory usage. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. Patch status is not explicitly stated in the input data; check the vendor advisory for the exact fixed kernel versions and apply updates accordingly.

Description

In the Linux kernel, the following vulnerability has been resolved: net: af_key: initialize alg_key_len for IPComp states pfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by allocating x->calg and copying only the algorithm name: x->calg = kmalloc_obj(*x->calg); if (!x->calg) { err = -ENOMEM; goto out; } strcpy(x->calg->alg_name, a->name); x->props.calgo = sa->sadb_sa_encrypt; Unlike the authentication (x->aalg) and encryption (x->ealg) branches of the same function, the compression branch never initializes calg->alg_key_len. IPComp carries no key and the allocation only reserves sizeof(struct xfrm_algo) (i.e. no room for a key), so the field is left containing uninitialized slab data. calg->alg_key_len is later used as a length by xfrm_algo_clone() when an IPComp state is cloned during XFRM_MSG_MIGRATE: xfrm_state_migrate() xfrm_state_clone_and_setup() x->calg = xfrm_algo_clone(orig->calg); kmemdup(orig, xfrm_alg_len(orig)); where xfrm_alg_len() returns sizeof(*alg) + (alg_key_len + 7) / 8. With a non-zero garbage alg_key_len, kmemdup() reads past the end of the 68-byte calg object. Adding an IPComp SA via PF_KEY and then migrating it triggers (net-next, KASAN, init_on_alloc=0): BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x44/0x60 Read of size 4164 at addr ff11000025a74980 by task diag2/9287 CPU: 3 UID: 0 PID: 9287 Comm: diag2 7.1.0-rc6-g903db046d557 #1 Call Trace: <TASK> dump_stack_lvl+0x10e/0x1f0 print_report+0xf7/0x600 kasan_report+0xe4/0x120 kasan_check_range+0x105/0x1b0 __asan_memcpy+0x23/0x60 kmemdup_noprof+0x44/0x60 xfrm_state_migrate+0x70a/0x1da0 xfrm_migrate+0x753/0x18a0 xfrm_do_migrate+0xb47/0xf10 xfrm_user_rcv_msg+0x411/0xb50 netlink_rcv_skb+0x158/0x420 xfrm_netlink_rcv+0x71/0x90 netlink_unicast+0x584/0x850 netlink_sendmsg+0x8b0/0xdc0 ____sys_sendmsg+0x9f7/0xb90 ___sys_sendmsg+0x134/0x1d0 __sys_sendmsg+0x16d/0x220 do_syscall_64+0x116/0x7d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 9287: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 pfkey_add+0x2652/0x2ea0 pfkey_process+0x6d0/0x830 pfkey_sendmsg+0x42c/0x850 __sys_sendto+0x461/0x4b0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x116/0x7d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ff11000025a74980 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes inside of allocated 68-byte region [ff11000025a74980, ff11000025a749c4) Depending on the uninitialized value the same field can instead request an oversized kmemdup() allocation and make the migration clone fail. The XFRM netlink path is not affected: verify_one_alg() rejects an XFRMA_ALG_COMP attribute shorter than xfrm_alg_len(), so a calg added via XFRM_MSG_NEWSA is always self-consistent. Initialize calg->alg_key_len to 0, matching the aalg/ealg branches.

Impact

The vulnerability can cause out-of-bounds memory reads in kernel space during migration of IPComp states, potentially leading to kernel crashes or memory corruption. This affects the stability and security of the kernel's networking subsystem handling IPComp. There is no indication of remote code execution or privilege escalation from the provided data. The issue is triggered by adding an IPComp Security Association via PF_KEY and migrating it.

Summary

The Linux kernel's pfkey_msg2xfrm_state() function mishandles IPComp (SADB_X_SATYPE_IPCOMP) states by allocating the compression algorithm structure (calg) without initializing the alg_key_len field. Since IPComp carries no key, the allocated memory is smaller and alg_key_len remains uninitialized, containing garbage data. Later, during XFRM_MSG_MIGRATE operations, xfrm_algo_clone() uses alg_key_len to determine the size of memory to duplicate. If alg_key_len is non-zero garbage, kmemdup() reads beyond the allocated memory, causing slab-out-of-bounds errors detected by KASAN. This can lead to kernel memory corruption or crashes. The vulnerability does not affect the XFRM netlink path due to input validation. The fix initializes calg->alg_key_len to zero, aligning with other algorithm branches and preventing out-of-bounds access.

References

Community reviews

Loading reviews…