CVE-2026-97588 Linux CVE debrief

Who should care

Linux kernel administrators and developers, as well as security teams responsible for monitoring and patching Linux systems, should assess exposure and verify key conversion processes and error handling.

Why it matters

CVE-2026-97588 is a Linux kernel vulnerability that could cause indefinite blocking of callers using crypto_wait_req(). Verification of exposure and remediation is necessary to prevent potential system instability.

• Verification of Linux kernel versions and configurations is necessary to determine exposure
• Indefinite blocking of callers using crypto_wait_req() could lead to system instability
• Proper error propagation and callback invocation are crucial for maintaining system reliability

Technical summary

The Linux kernel vulnerability (CVE-2026-97588) involves a situation where hardware persistently returns -EBUSY after exhausting retries, causing the error to propagate to crypto_finalize_*_request(). The crypto API's completion wrapper treats -EBUSY as a queueing status and swallows it, preventing the completion callback from firing. This causes callers using crypto_wait_req() to block indefinitely. The issue has been resolved by translating persistent -EBUSY to -EIO after retry exhaustion to ensure proper error propagation and callback invocation.

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel configurations and versions to assess exposure
• Verify key conversion processes and error handling
• Monitor for potential blocking issues with crypto_wait_req()
• Perform a thorough review of system logs to identify any instances of indefinite blocking
• Implement additional monitoring to detect similar issues in the future
• Develop a plan to apply vendor patches or mitigations as needed
• Track and document the verification process and any resulting changes

Evidence notes

The CVE record and NVD entry provide details on the Linux kernel vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.