CVE-2026-80843: Linux Kernel Information Disclosure Vulnerability

CVE-2026-80843 Overview

CVE-2026-80843 is a memory leak vulnerability in the Linux kernel's IPsec transformation (xfrm) subsystem. The flaw resides in xfrm_state_construct() and its interaction with attach_auth_trunc(). When an authentication algorithm without an sadb_alg_id is selected — cmac(aes) being one real case — attach_auth_trunc() allocates x->aalg but leaves x->props.aalgo at zero. The subsequent code path treats a zero aalgo as "no auth algorithm attached" and calls attach_auth(), which overwrites the earlier x->aalg pointer. Any later failure or teardown frees only the replacement, leaking the original allocation.

Critical Impact
Repeated triggering of the affected code path leaks kernel memory, degrading system stability and increasing exposure to resource exhaustion over time.

Affected Products

Linux kernel (upstream stable trees, xfrm subsystem)
Distributions shipping affected kernels prior to the referenced stable commits
Systems using IPsec with authentication algorithms lacking an sadb_alg_id (for example, cmac(aes))

Discovery Timeline

2026-09-04 - CVE CVE-2026-80843 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80843

Vulnerability Analysis

The defect exists in the Linux kernel xfrm (IPsec transformation) state construction logic. xfrm_state_construct() builds a security association (SA) by attaching cryptographic algorithm state to an xfrm_state structure. Two helpers can attach an authentication algorithm: attach_auth() and attach_auth_trunc().

attach_auth_trunc() allocates the x->aalg structure for authentication with a truncated ICV. However, when the selected algorithm does not expose an sadb_alg_id, the helper allocates the buffer without setting x->props.aalgo. Downstream code uses x->props.aalgo as a proxy for whether an auth algorithm is attached. Seeing a zero value, it invokes attach_auth(), which allocates a second x->aalg and overwrites the pointer to the first.

The first allocation becomes unreachable. Cleanup routines free only the pointer currently stored in x->aalg, so the original buffer leaks. Attackers or misconfigured userspace tooling repeatedly creating and tearing down affected SAs can drive sustained kernel memory loss.

Root Cause

The root cause is an incorrect state check. The code infers "auth algorithm not yet attached" from !x->props.aalgo, which is unreliable because attach_auth_trunc() can attach x->aalg without setting aalgo. The fix replaces the inference with a direct check of whether x->aalg is already populated. This eliminates the double-attach path and prevents the pointer overwrite.

Attack Vector

Exploitation requires the ability to configure IPsec SAs, typically via PF_KEY or Netlink XFRM sockets, which generally requires CAP_NET_ADMIN. A local privileged process or a network namespace with the appropriate capability can request auth algorithms lacking an sadb_alg_id (such as cmac(aes)) to trigger the leak on each state construction. There is no evidence of remote unauthenticated exploitation. Refer to the upstream fix commit and the additional stable backports listed in the references for the exact code paths.

Detection Methods for CVE-2026-80843

Indicators of Compromise

Steady, unexplained growth in kernel slab allocations associated with xfrm authentication state.
Repeated XFRM_MSG_NEWSA or SADB_ADD operations specifying auth algorithms without an sadb_alg_id, notably cmac(aes).
dmesg warnings from kmemleak referencing xfrm_state, aalg, or attach_auth_trunc call stacks.

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on non-production kernels and correlate leaks against xfrm code paths.
Audit hosts and containers for kernel versions predating the stable commits listed under references.
Monitor /proc/net/xfrm_stat and slab counters (slabtop, /proc/slabinfo) for anomalous growth on IPsec gateways.

Monitoring Recommendations

Alert on sustained increases in kernel memory usage on hosts running IPsec with non-standard auth algorithms.
Log Netlink XFRM and PF_KEY activity from userspace daemons (strongSwan, libreswan, iproute2) for unusual SA churn.
Track kernel package versions across the fleet to confirm patched builds are deployed.

How to Mitigate CVE-2026-80843

Immediate Actions Required

Inventory Linux hosts running IPsec workloads and identify kernels that predate the fix commits.
Prioritize patching IPsec gateways, VPN concentrators, and multi-tenant hosts where SA churn is highest.
Restrict CAP_NET_ADMIN and control access to PF_KEY/XFRM Netlink sockets to trusted administrators only.

Patch Information

The upstream fix updates xfrm_state_construct() to check whether x->aalg is already attached instead of relying on x->props.aalgo. The change has been backported across stable trees. Apply the vendor kernel update that includes one of the referenced commits, for example commit 958ae9f2, commit be19d20e, or commit fb7f3e74. Distribution-provided kernel packages should be preferred over manual builds where available.

Workarounds

Avoid configuring IPsec SAs with authentication algorithms that lack an sadb_alg_id, such as cmac(aes), until the patch is deployed.
Reduce SA creation and teardown frequency on affected hosts to limit cumulative leak impact.
Reboot IPsec gateways on a scheduled cadence to reclaim leaked memory as a temporary measure only.

bash

# Verify kernel version and check for the fix
uname -r

# Debian/Ubuntu: apply latest kernel update
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)

# RHEL/Rocky/Alma: apply latest kernel update
sudo dnf update kernel

# Reboot to activate patched kernel
sudo systemctl reboot