{"id":"CVE-2026-43493","state":"PUBLISHED","title":"crypto: pcrypt - Fix handling of MAY_BACKLOG requests","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix handling of MAY_BACKLOG requests\n\nMAY_BACKLOG requests can return EBUSY.  Handle them by checking\nfor that value and filtering out EINPROGRESS notifications.","publishedAt":"2026-05-19T10:44:25.402Z","updatedAt":"2026-10-19T19:26:37.700Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"ae7e95638d956d556d74b9abb9e780d3bd3dcd9e","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"1d7f07df450bac3301938fbc4251f2611be4084e","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"76641449b28979ebd6c02e9598367e119e385236","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"9f1cbca178c03188e201ed175251372149bb25f2","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"eb34e243df57e32f4c08fa191f3602ea19076276","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"77d55bc8675ee851ed639dc9be77325a8024cf67","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"915b692e6cb723aac658c25eb82c58fd81235110","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["crypto/pcrypt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.34","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.34","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.86","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.27","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.4","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["crypto/pcrypt.c"]}],"references":["https://git.kernel.org/stable/c/ae7e95638d956d556d74b9abb9e780d3bd3dcd9e","https://git.kernel.org/stable/c/1d7f07df450bac3301938fbc4251f2611be4084e","https://git.kernel.org/stable/c/76641449b28979ebd6c02e9598367e119e385236","https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2","https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276","https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67","https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a","https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":["CWE-390"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43493.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43493","state":"PUBLISHED","datePublished":"2026-05-19T10:44:25.402Z","dateUpdated":"2026-10-19T19:26:37.700Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-01T14:12:56.013Z"},"containers":{"cna":{"title":"crypto: pcrypt - Fix handling of MAY_BACKLOG requests","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix handling of MAY_BACKLOG requests\n\nMAY_BACKLOG requests can return EBUSY.  Handle them by checking\nfor that value and filtering out EINPROGRESS notifications."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"ae7e95638d956d556d74b9abb9e780d3bd3dcd9e","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"1d7f07df450bac3301938fbc4251f2611be4084e","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"76641449b28979ebd6c02e9598367e119e385236","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"9f1cbca178c03188e201ed175251372149bb25f2","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"eb34e243df57e32f4c08fa191f3602ea19076276","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"77d55bc8675ee851ed639dc9be77325a8024cf67","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a","versionType":"git"},{"version":"5a1436beec5744029f3ac90b6fe71a698dcd6155","status":"affected","lessThan":"915b692e6cb723aac658c25eb82c58fd81235110","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["crypto/pcrypt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.34","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.34","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.86","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.27","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.4","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["crypto/pcrypt.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ae7e95638d956d556d74b9abb9e780d3bd3dcd9e"},{"url":"https://git.kernel.org/stable/c/1d7f07df450bac3301938fbc4251f2611be4084e"},{"url":"https://git.kernel.org/stable/c/76641449b28979ebd6c02e9598367e119e385236"},{"url":"https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2"},{"url":"https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276"},{"url":"https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67"},{"url":"https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a"},{"url":"https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - pcrypt AEAD can sit under network-facing kernel crypto consumers such as kTLS/TIPC that process peer-supplied records or packets. In the highest reasonable deployment, a remote peer can drive the vulnerable encrypt/decrypt path through network traffic.\nAC:L - The trigger is child crypto backlog behavior under `CRYPTO_TFM_REQ_MAY_BACKLOG`; an attacker can induce queue pressure with concurrent requests or traffic. There is no race that depends on conditions outside the attacker's control.\nPR:N - The network-facing path requires no kernel privileges from the remote peer. The local AF_ALG AEAD path also has no capability gate, but the higher-severity network scenario is defensible.\nUI:N - No victim interaction is required once the affected crypto consumer is configured. The attacker only sends data or submits crypto requests.\nS:U - The bug corrupts kernel crypto/request state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - Mishandling `-EBUSY` can complete and free the request while the child request remains queued, leading to use-after-free on later callbacks. A kernel UAF is reasonably exploitable for high-impact information disclosure.\nI:H - The stale callback reuses freed request/padata memory and can drive list operations and completion paths on attacker-reclaimed objects. This is memory corruption with a plausible path to arbitrary write or control-flow corruption.\nA:H - At minimum, the premature completion and later queued callback can dereference or manipulate freed kernel memory. That can produce kernel oops/panic or list corruption, giving high availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:28:16.602Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"5.10.258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"6.12.86"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"6.18.27"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"7.0.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:19:26.688Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-43493","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:17:44.453814Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-390","lang":"en","type":"CWE","description":"CWE-390 Detection of Error Condition Without Action"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:26:37.700Z"}}]}}}