PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46033 Linux CVE debrief

A vulnerability in the Linux kernel's authencesn crypto driver allowed creation of AEAD transforms with invalid default authentication sizes when paired with hash algorithms having digest sizes of 1-3 bytes. The ESN (Extended Sequence Number) code paths require at least 4 bytes of authentication tag space to handle high-order sequence number data. While explicit setauthsize() calls rejected invalid sizes, the transform creation path failed to validate the ahash digest size when initializing the default authsize. This could lead to out-of-bounds memory access when AF_ALG users triggered ESN operations on such misconfigured transforms. The fix adds validation during instance creation to reject ahash digest sizes in the invalid 1-3 byte range.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-08-20
Advisory published
2026-05-27
Advisory updated
2026-08-20

Who should care

Linux system administrators, kernel maintainers, container platform operators, and security teams monitoring crypto API attack surface in multi-tenant environments

Technical summary

The authencesn AEAD template in Linux kernel crypto subsystem failed to validate ahash digest sizes during transform instantiation. When combined with algorithms like cbcmac(cipher_null) producing 1-3 byte digests, the resulting transform inherited an invalid default authsize that the ESN encrypt/decrypt paths would use to access 4 bytes of sequence number data at the end of authenticated regions. This caused out-of-bounds memory access. The vulnerability was exploitable through AF_ALG sockets where unprivileged users could instantiate such transforms. The fix enforces minimum 4-byte digest size requirement (or zero) during crypto_authenc_esn_create(), preventing instantiation of vulnerable transform configurations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Verify crypto API usage does not rely on authencesn with cbcmac(cipher_null) or similar short-digest ahash algorithms
  • Monitor vendor security advisories for kernel package updates addressing CVE-2026-46033
  • Review AF_ALG socket usage in containerized environments where unprivileged crypto access may be exposed

Evidence notes

CVE description confirms the vulnerability exists in crypto: authencesn and was resolved by rejecting short ahash digests during instance creation. Multiple stable kernel commits are referenced, indicating backports to supported branches. No CVSS score or severity assigned yet per NVD status 'Awaiting Analysis'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46033 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46033

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46033 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46033

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5db6ef9847717329f12c5ea8aba7e9f588a980c0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/67f1f0933cc3d78dde222842bcad2778ec7a0b88

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9aff81e8217e9de2929084b03b3c7f81988c112b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b42821c15445f93daea3e76ada682b2b7181c476

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b69933e97efea238ebbfcf70c2b1be1cd03f13e3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.