CVE-2026-46033
Vulnérabilité élevée dans Linux (Linux)
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject short ahash digests during instance creation authencesn requires either a zero authsize or an authsize of at least 4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of high-order sequence number data at the end of the authenticated data. While crypto_authenc_esn_setauthsize() already rejects explicit non-zero authsizes in the range 1..3, crypto_authenc_esn_create() still copied auth->digestsize into inst->alg.maxauthsize without validating it. The AEAD core then initialized the tfm's default authsize from that value. As a result, selecting an ahash with digest size 1..3, such as cbcmac(cipher_null), exposed authencesn instances whose default authsize was invalid even though setauthsize() would have rejected the same value. AF_ALG could then trigger the ESN tail handling with a too-short tag and hit an out-of-bounds access. Reject authencesn instances whose ahash digest size is in the invalid non-zero range 1..3 so that no tfm can inherit an unsupported default authsize.
Gravité et risque d'exploitation
CVE-2026-46033 obtient un score CVSS de 7.1/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.18 %, ce qui la place devant 7.2 % des CVE référencées.
Que faire ?
- Vérifiez si Linux (versions <d4c6a6d08e70bb1083c7c405fc7faacbf19aebc0, 7.0.4, <=6.1.*, <=7.0.*, <=6.12.*, 4.11, 0, 6.18.27, <9aff81e8217e9de2929084b03b3c7f81988c112b, 5.15.209, <67f1f0933cc3d78dde222842bcad2778ec7a0b88, <=5.10.*, <=6.6.*, 6.1.175, <5db6ef9847717329f12c5ea8aba7e9f588a980c0, <4.11, 7.1, <=6.18.*, 5.10.258, f15f05b0a5de667c821a9727c33bce9d1d9b26dd, <=*, <77f59fb2d3aa33e90ec6cbbf45dcfb20ab82b1a9, <b42821c15445f93daea3e76ada682b2b7181c476, <=5.15.*, <2f31cd1e64a079c845bca31d2da7b3c90a311726, <b69933e97efea238ebbfcf70c2b1be1cd03f13e3, 6.6.140, 6.12.86) est présent sur votre parc.
- Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
- À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
- Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.
Références
- https://git.kernel.org/stable/c/77f59fb2d3aa33e90ec6cbbf45dcfb20ab82b1a9
- https://git.kernel.org/stable/c/2f31cd1e64a079c845bca31d2da7b3c90a311726
- https://git.kernel.org/stable/c/d4c6a6d08e70bb1083c7c405fc7faacbf19aebc0
- https://git.kernel.org/stable/c/b69933e97efea238ebbfcf70c2b1be1cd03f13e3
- https://git.kernel.org/stable/c/67f1f0933cc3d78dde222842bcad2778ec7a0b88
- https://git.kernel.org/stable/c/b42821c15445f93daea3e76ada682b2b7181c476
- https://git.kernel.org/stable/c/9aff81e8217e9de2929084b03b3c7f81988c112b
- https://git.kernel.org/stable/c/5db6ef9847717329f12c5ea8aba7e9f588a980c0