CVE-2026-68125
Received Received - Intake

mac802154 llsec Authentication Tag Length Validation Flaw

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame whose payload is shorter than the tag makes datalen - authlen negative; assoclen is then passed to aead_request_set_ad() as an unsigned value close to 4 GiB, so crypto_aead_decrypt() walks far off the end of the scatterlist that only spans the real frame. The frame is fully attacker-controlled and reaches this path from any IEEE 802.15.4 peer in radio range. Reject frames whose payload is shorter than the authentication tag before the subtraction. Dynamically reproduced on a KASAN kernel as a general-protection-fault in the AEAD scatterwalk, and the fix confirmed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68125
EUVD
EUVD-2026-55506

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the mac802154 subsystem's llsec component. It allows an attacker within radio range to send a specially crafted IEEE 802.15.4 frame with a payload shorter than the authentication tag. This causes the kernel to miscalculate the data length, leading to an out-of-bounds memory access during cryptographic decryption.

Detection Guidance

This vulnerability affects the Linux kernel's mac802154 subsystem, specifically in the llsec component handling IEEE 802.15.4 frames. Detection requires monitoring for malformed frames with payloads shorter than the authentication tag (4, 8, or 16 bytes). Use kernel logs for AEAD-related errors or crashes, such as general-protection faults in scatterwalk. Check for IEEE 802.15.4 radio traffic anomalies.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system via a general protection fault. It may also potentially enable unauthorized access or data leakage if exploited further, though the exact impact depends on system configuration and usage.

Mitigation Strategies

Apply the Linux kernel patch resolving the issue in mac802154 llsec. Update to a patched kernel version. Disable IEEE 802.15.4 interfaces if not required. Monitor network traffic for malformed frames. Ensure AEAD cryptographic operations are validated for frame length before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart