crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 15 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Deferred
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of type u32. However, some assignments to these fields, specifically 'more' and 'merge', assign values greater than 1. These relied on C's implicit conversion to bool, such that zero becomes false and nonzero becomes true. With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken instead, resulting in 0 being assigned in some cases when 1 was intended. Fix this by restoring the bool type.
References
- https://git.kernel.org/stable/c/3a21698ace915a445bce2d0dcfc84b6d2199baf7
- https://git.kernel.org/stable/c/d382d6daf0184490f366562469a5673f65ee2662
- https://git.kernel.org/stable/c/54506c6335690f4ef1b9f154e34f5a604c72c1ed
- https://git.kernel.org/stable/c/8703940bd30b5ad94408d28d7192db2491cd3592
- https://git.kernel.org/stable/c/316b090c2fee964c307a634fecc7df269664b158
- https://git.kernel.org/stable/c/fbe96bd25423e61273d8831e995260b429d850b6
- https://git.kernel.org/stable/c/d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
European references
- ENISA EUVD · EUVD-2025-35837
- GCVE · GCVE-0-2025-40022
CERT-FR advisories
- CERTFR-2026-AVI-1335 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1298 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1231 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0880 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1136 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1048 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1010 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce < 3a21698ace915a445bce2d0dcfc84b6d2199baf7 ; affected e4c1ec11132ec466f7362a95f36a506ce4dc08c9 < d382d6daf0184490f366562469a5673f65ee2662 ; affected 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 < 54506c6335690f4ef1b9f154e34f5a604c72c1ed ; affected 7c4491b5644e3a3708f3dbd7591be0a570135b84 < 8703940bd30b5ad94408d28d7192db2491cd3592 ; affected 9aee87da5572b3a14075f501752e209801160d3d < 316b090c2fee964c307a634fecc7df269664b158 ; affected 45bcf60fe49b37daab1acee57b27211ad1574042 < fbe96bd25423e61273d8831e995260b429d850b6 |
| Linux · Linux | affected 6.1.154 < 6.1.155 ; affected 6.6.108 < 6.6.109 ; affected 6.12.49 < 6.12.50 ; affected 6.16.9 < 6.16.10 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |