CVE-2026-46193 Linux CVE debrief

Who should care

Organizations running Linux-based IPsec VPNs or secure networking infrastructure using AH with ESN enabled, particularly those utilizing asynchronous cryptographic hardware accelerators. Cloud providers and enterprises with high-throughput IPsec requirements using hardware offload for AH authentication. Security teams managing kernel-level networking stacks with XFRM configurations.

Technical summary

The vulnerability exists in the Linux kernel's XFRM subsystem, specifically in the Authentication Header (AH) implementation's handling of asynchronous cryptographic operations with Extended Sequence Number (ESN) enabled. When ESN is active, the async ahash setup allocates a 4-byte seqhi slot preceding the ICV/auth_data area. However, the async completion callbacks (ah4_output_done, ah4_input_done, and IPv6 equivalents) reconstruct the temporary buffer layout without accounting for this seqhi slot, resulting in a 4-byte offset error. This causes incorrect ICV comparison on input and wrong ICV placement on output, leading to authentication failures and complete packet loss. The fix aligns callback-side layout reconstruction with the setup path by properly skipping the ESN seqhi slot. Per RFC 4302, ESN high-order 32 bits must participate in AH ICV computation, making this accounting mandatory for correct operation.

Defensive priority

high

Recommended defensive actions

• Apply kernel patches from stable branches when available for your distribution
• Verify XFRM AH configurations for ESN usage in IPsec deployments
• Monitor for kernel updates addressing this fix in net/ipv4/ah4.c and net/ipv6/ah6.c
• If using async hardware AH accelerators with ESN, test thoroughly after patching
• Consider temporarily disabling ESN on AH SAs if async AH implementations are in use and patches cannot be immediately applied

Evidence notes

The vulnerability description indicates successful reproduction in UML (User-Mode Linux) with IPv4 AH + ESN + forced async hmac(sha1), showing pre-fix offset drift (icv_off=20 vs expected_off=24) and post-fix correction (icv_off=24 matching expected). IPv6 AH+ESN was not runtime tested, nor was real async hardware AH engine validation performed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.