CVE-2026-46193
Buffer Overflow in Linux Kernel XFRM AH
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's implementation of the Authentication Header (AH) protocol when Extended Sequence Number (ESN) is enabled and asynchronous hashing (async ahash) is used.
The issue arises because the async AH setup adds a 4-byte sequence high (seqhi) slot before the Integrity Check Value (ICV) or authentication data, but the async completion callbacks incorrectly reconstruct the layout as if this seqhi slot were absent.
As a result, AH copies or compares incorrect bytes on both IPv4 and IPv6 paths, leading to failures such as 100% packet loss in certain test scenarios.
The fix involves making the async callbacks reconstruct the layout correctly by accounting for the seqhi slot, aligning with RFC 4302 which states that the ESN high-order 32 bits participate in the AH ICV computation.
How can this vulnerability impact me? :
This vulnerability can cause the Authentication Header (AH) protocol to malfunction when ESN and asynchronous hashing are used, resulting in incorrect authentication checks.
In practical terms, this can lead to communication failures such as 100% packet loss in IPv4 AH with ESN enabled, as the system incorrectly processes authentication data.
Such failures can disrupt secure network communications that rely on AH for integrity and authentication, potentially causing denial of service or loss of connectivity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability relates to the Linux kernel's handling of AH (Authentication Header) with ESN (Extended Sequence Number) in asynchronous callbacks. Detection involves observing abnormal behavior in AH+ESN traffic, such as packet loss or errors in authentication callbacks.
For example, in a UML (User Mode Linux) environment with IPv4 AH+ESN and forced async hmac(sha1), ping commands may fail with 100% packet loss, and kernel logs may show messages like:
- ah4 output_done: esn=1 err=0 icv_off=20 expected_off=24
- ah4 input_done: esn=1 auth_off=20 expected_auth_off=24 icv_off=32 expected_icv_off=36
Monitoring kernel logs for such messages and testing AH+ESN traffic with ping or similar tools can help detect the presence of this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by correcting the async AH implementation to properly account for the ESN seqhi slot in the authentication data layout.
Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix for this vulnerability.
- Avoid using asynchronous AH implementations with ESN enabled until the fix is applied.
- Monitor network traffic and kernel logs for signs of AH+ESN authentication failures.