Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-71131

crypto: seqiv - Do not use req->iv after crypto_aead_encrypt

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid. Instead of checking req->iv against info, create a new variable unaligned_info and use it for that purpose instead.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0a270321dbf948963aeb0e8382fe17d2c2eb3771 to < 18202537856e0fae079fed2c9308780bcff2bb9daffected
  • 0a270321dbf948963aeb0e8382fe17d2c2eb3771 to < baf0e2d1e03ddb04781dfe7f22a654d3611f69b2affected
  • 0a270321dbf948963aeb0e8382fe17d2c2eb3771 to < 50f196d2bbaee4ab2494bb1b0d294deba292951aaffected
  • 0a270321dbf948963aeb0e8382fe17d2c2eb3771 to < 0279978adec6f1296af66b642cce641c6580be46affected
  • 0a270321dbf948963aeb0e8382fe17d2c2eb3771 to < ccbb96434d88e32358894c879457b33f7508e798affected
  • 0a270321dbf948963aeb0e8382fe17d2c2eb3771 to < 5476f7f8a311236604b78fcc5b2a63b3a61b0169affected
  • 0a270321dbf948963aeb0e8382fe17d2c2eb3771 to < 50fdb78b7c0bcc550910ef69c0984e751cac72faaffected

Linux Linux

Default version status: affected

  • 2.6.25affected
  • 0 to < 2.6.25unaffected
  • 5.10.248 to ≤ 5.10.*unaffected
  • 5.15.198 to ≤ 5.15.*unaffected
  • 6.1.160 to ≤ 6.1.*unaffected
  • 6.6.120 to ≤ 6.6.*unaffected
  • 6.12.64 to ≤ 6.12.*unaffected
  • 6.18.4 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References