Search: CVE-2026-46028

A vulnerability in the Linux kernel's algif_aead module related to asynchronous AEAD cryptographic requests was resolved. The issue involved the use of a socket-wide IV buffer that could be modified by concurrent socket activity before the original request completed, leading to inconsistent IV handling. This flaw could allow a local attacker to escalate privileges or escape a container. The vulnerability has been addressed by snapshotting the IV into per-request storage to prevent dependency on mutable socket state. Fixes are available in updated Linux kernel packages, and a system reboot is required after applying updates.