CVE-2026-43077 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators of systems that use the kernel's AF_ALG/algif_aead crypto interface should review this CVE and ensure patched kernel builds are deployed.

Technical summary

According to the supplied kernel fix description, the decryption receive-size validation in crypto: algif_aead was too small because it did not include the AEAD tag size. That means requests that were sized according to the old check could be rejected or handled incorrectly during decryption. NVD classifies the issue as local, low-privilege, no-user-interaction, availability-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Defensive priority

Medium priority for Linux kernel patching, especially on systems that expose or rely on the algif_aead AF_ALG interface.

Recommended defensive actions

• Apply the available Linux kernel patches referenced in the NVD record.
• Upgrade affected kernel branches to the first fixed releases listed by NVD for your track.
• If you cannot patch immediately, reduce exposure by limiting local user access on affected systems where practical.
• Validate that your kernel update process covers all deployed branches, including long-term support lines and release candidates where applicable.
• Monitor for follow-on advisories from your Linux distribution or kernel vendor, but treat the official kernel patch links as the primary remediation source.

Evidence notes

Evidence is limited to the supplied NVD record and linked official kernel patches. NVD marks the vulnerability as analyzed, published on 2026-05-06 and modified on 2026-05-20, with CVSS 5.5 / AV:L / AC:L / PR:L / UI:N / S:U / C:N / I:N / A:H. NVD also provides affected Linux kernel version ranges and official patch references on git.kernel.org. No KEV listing was supplied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.