CVE-2026-74578

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: algif_skcipher - force synchronous processing on trees without ctx-&gt;state<br /> <br /> The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-&gt;iv<br /> directly into the skcipher request. After io_submit() the socket lock is<br /> dropped and the request is processed asynchronously, so a concurrent<br /> sendmsg(ALG_SET_IV) can overwrite ctx-&gt;iv and make the in-flight request<br /> run under an attacker-controlled IV. For CTR/stream modes this is<br /> IV/keystream reuse and lets an unprivileged user recover the plaintext of<br /> a concurrent operation.<br /> <br /> Snapshotting ctx-&gt;iv into per-request storage for the async path is not<br /> sufficient. For ciphers with statesize == 0 - which includes cbc and ctr -<br /> the MSG_MORE inter-chunk IV chaining is carried solely by the in-place<br /> req-&gt;iv writeback, which a snapshot redirects into per-request memory that<br /> af_alg_free_resources() releases on completion, silently producing wrong<br /> output. Writing the IV back from the completion callback instead is not<br /> possible either: that would require lock_sock() there, but the callback can<br /> run in softirq/atomic context, so it must not sleep.<br /> <br /> Make the operation synchronous instead, which removes both the IV race and<br /> any writeback race. This is equivalent to the upstream resolution, commit<br /> fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the<br /> AIO socket path across net/ entirely and so produces the same end state for<br /> this file. This patch deviates from that commit deliberately: rather than<br /> removing AIO socket support tree-wide, which would be far too invasive for<br /> stable, it removes only the AIO branch in crypto/algif_skcipher.c.<br /> io_submit() now completes synchronously; AF_ALG async is rarely used in<br /> practice.<br /> <br /> The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,<br /> and is left alone to keep the fix minimal.<br /> <br /> Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000<br /> after the change; MSG_MORE chunked CTR output bit-identical to single-shot.