CVE-2026-98805: Linux kernel · tipc: prevent GCM nonce reuse on peer key changes
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f74f100e49588c1dbdc6ab3ba9e2c67b36d015d0 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:18 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f74f100e49588c1dbdc6ab3ba9e2c67b36d015d0, a85a3dce4b6c73ddaa1e9725b906249744bf7cf2, 512ccd3d0e91e791fb37442aa0a2599aca19783d +2
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
Description
In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix (a per-key salt XOR the peer's address) followed by a 64-bit counter. That counter is stored in the peer's RX crypto object. When the peer reports a change in which key it uses to receive packets, TIPC resets this counter. The sender can still be using the same TX key and salt, so subsequent packets reuse earlier nonces. This nonce reuse breaks confidentiality and exposes GCM's authentication key. This makes forgeries trivial: an attacker can exploit CTR malleability to alter captured ciphertexts and use the recovered authentication key to compute a valid tag for the modified ciphertext, under the same key and nonce. Use the TX key's existing aead->seqno counter instead. All encryptions using that key object share the same atomic counter, so concurrent encryptions get distinct nonce counter values. The counter survives key activation and peer reconnection, and peer key-status reports cannot reset it. This prevents those transitions from causing nonce reuse while the same TX key remains installed. The nonce format is unchanged, and receivers do not require consecutive counter values, so sharing the counter across peers remains compatible with existing receivers. A pre-existing check still invokes key revocation in the unlikely event that the counter wraps to zero.
References
- git.kernel.org/stable/c/a85a3dce4b6c73ddaa1e9725b906249744bf7cf2 (opens in a new tab)
- git.kernel.org/stable/c/5c8ce13c792e28d56f9ec3cd6728d8225bc0e3a2 (opens in a new tab)
- git.kernel.org/stable/c/f74f100e49588c1dbdc6ab3ba9e2c67b36d015d0 (opens in a new tab)
- git.kernel.org/stable/c/60e0c2aeaa605ff19ca4e65126a35643d4d7ee1c (opens in a new tab)
- git.kernel.org/stable/c/512ccd3d0e91e791fb37442aa0a2599aca19783d (opens in a new tab)