CVE-2026-68125

Received Received - Intake

mac802154 llsec Authentication Tag Length Validation Flaw

Publication date: 2026-08-10

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame whose payload is shorter than the tag makes datalen - authlen negative; assoclen is then passed to aead_request_set_ad() as an unsigned value close to 4 GiB, so crypto_aead_decrypt() walks far off the end of the scatterlist that only spans the real frame. The frame is fully attacker-controlled and reaches this path from any IEEE 802.15.4 peer in radio range. Reject frames whose payload is shorter than the authentication tag before the subtraction. Dynamically reproduced on a KASAN kernel as a general-protection-fault in the AEAD scatterwalk, and the fix confirmed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68125

EUVD

EUVD-2026-55506

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the mac802154 subsystem's llsec component. It allows an attacker within radio range to send a specially crafted IEEE 802.15.4 frame with a payload shorter than the authentication tag. This causes the kernel to miscalculate the data length, leading to an out-of-bounds memory access during cryptographic decryption.

Detection Guidance

This vulnerability affects the Linux kernel's mac802154 subsystem, specifically in the llsec component handling IEEE 802.15.4 frames. Detection requires monitoring for malformed frames with payloads shorter than the authentication tag (4, 8, or 16 bytes). Use kernel logs for AEAD-related errors or crashes, such as general-protection faults in scatterwalk. Check for IEEE 802.15.4 radio traffic anomalies.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system via a general protection fault. It may also potentially enable unauthorized access or data leakage if exploited further, though the exact impact depends on system configuration and usage.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue in the Linux mac802154 subsystem. Compliance impacts would depend on whether the affected system processes sensitive data, but the vulnerability itself is unrelated to data protection requirements.

Mitigation Strategies

Apply the Linux kernel patch resolving the issue in mac802154 llsec. Update to a patched kernel version. Disable IEEE 802.15.4 interfaces if not required. Monitor network traffic for malformed frames. Ensure AEAD cryptographic operations are validated for frame length before processing.

Hi! I’m here to help you understand CVE-2026-68125. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...