CVE-2026-43078: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43078 Overview

CVE-2026-43078 is a Linux kernel vulnerability in the af_alg cryptographic socket interface. The flaw resides in af_alg_pull_tsgl, where a page reassignment loop can iterate one position beyond the intended bounds. When page reassignment logic was originally added to this function, the controlling loop was not updated to account for the new behavior. As a result, the function may attempt to reassign one more page than necessary, leading to an out-of-bounds access on the temporary scatter-gather list.

Critical Impact
The off-by-one in af_alg_pull_tsgl can corrupt adjacent kernel memory or trigger instability when local users invoke the AF_ALG socket interface for cryptographic operations.

Affected Products

Linux kernel (mainline) versions containing the original af_alg_pull_tsgl page reassignment logic
Linux kernel stable branches receiving backported fixes (multiple commit references published by kernel.org)
Distributions packaging affected stable kernels prior to applying the upstream patches

Discovery Timeline

2026-05-06 - CVE-2026-43078 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43078

Vulnerability Analysis

The Linux kernel exposes user-space cryptographic operations through the AF_ALG socket family. Internally, kernel code uses a temporary scatter-gather list (tsgl) to track pages submitted by user space for hashing or symmetric cipher operations. The function af_alg_pull_tsgl is responsible for releasing or reassigning these pages once the kernel has consumed the associated data.

When page reassignment support was added to this routine, the surrounding loop bounds were not adjusted to reflect the new logic. The loop therefore proceeds one iteration past the last valid page entry, attempting to reassign a page that does not exist in the active range. This off-by-one results in an out-of-bounds access against the scatter-gather array.

The upstream fix adds an explicit check inside the reassignment branch so that the function exits cleanly once the valid pages have been processed. The patch also corrects a stale comment that still referenced an obsolete offset argument.

Root Cause

The root cause is an unsynchronized refactor: the original loop in af_alg_pull_tsgl did not enforce the same boundary condition that the newly added page reassignment branch required. The condition that previously terminated processing was applied only to the release path and not to the reassignment path.

Attack Vector

Exploitation requires local access to a system where unprivileged use of AF_ALG sockets is permitted. An attacker triggers the condition by submitting crafted scatter-gather buffers through the kernel crypto socket interface, then invoking operations that drive af_alg_pull_tsgl past the intended boundary. The vulnerability is not exploitable over the network and has no associated public proof-of-concept at the time of publication.

No verified exploitation code is available. Refer to the Linux Kernel Commit dea5fcf08 and related stable backports for the exact source-level changes.

Detection Methods for CVE-2026-43078

Indicators of Compromise

Kernel oops or panic messages referencing af_alg_pull_tsgl or the algif modules in dmesg and /var/log/kern.log
KASAN slab-out-of-bounds reports tied to scatter-gather list pages on kernels built with memory sanitizers enabled
Unexpected process terminations in user-space services that use the kernel crypto API through AF_ALG

Detection Strategies

Inventory running kernel versions across Linux endpoints and compare them against the fixed stable releases referenced in the kernel.org commits
Monitor for unusual process activity invoking socket(AF_ALG, ...) system calls from non-crypto workloads using auditd or eBPF tracing
Correlate kernel ring buffer warnings with the loaded algif_hash, algif_skcipher, or algif_aead modules

Monitoring Recommendations

Enable auditd rules on the socket syscall with the AF_ALG family to baseline legitimate consumers
Forward kernel logs to a centralized SIEM or data lake to detect crash signatures across the fleet
Track package and kernel update status through configuration management to confirm patch deployment

How to Mitigate CVE-2026-43078

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the kernel.org commits as soon as distribution updates are available
Restrict access to the AF_ALG socket family on systems that do not require user-space access to kernel crypto, for example through seccomp or namespace isolation
Reboot affected hosts after kernel updates so the patched image is loaded into memory

Patch Information

The fix is distributed across multiple stable branches. Relevant references include Linux Kernel Commit 2b781d1d, Linux Kernel Commit 31d00156e, Linux Kernel Commit 710a4ce5d, Linux Kernel Commit 9532501e0, Linux Kernel Commit c8369a6d6, Linux Kernel Commit dea5fcf08, Linux Kernel Commit f7826bc0b, and Linux Kernel Commit fa48d3ea9. Track your distribution's security advisory channel for the corresponding package versions.

Workarounds

Blacklist the algif_hash, algif_skcipher, algif_aead, and algif_rng modules on hosts that do not require AF_ALG functionality
Apply seccomp profiles to containerized workloads to deny the AF_ALG socket family until kernels are patched
Limit local user accounts and untrusted code execution on systems exposing the kernel crypto socket interface

bash

# Configuration example: prevent algif modules from loading until patched
echo 'install algif_hash /bin/true' | sudo tee /etc/modprobe.d/disable-af_alg.conf
echo 'install algif_skcipher /bin/true' | sudo tee -a /etc/modprobe.d/disable-af_alg.conf
echo 'install algif_aead /bin/true' | sudo tee -a /etc/modprobe.d/disable-af_alg.conf
echo 'install algif_rng /bin/true' | sudo tee -a /etc/modprobe.d/disable-af_alg.conf
sudo update-initramfs -u