CVE-2026-64436

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: af_key: initialize alg_key_len for IPComp states<br /> <br /> pfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by<br /> allocating x-&gt;calg and copying only the algorithm name:<br /> <br /> x-&gt;calg = kmalloc_obj(*x-&gt;calg);<br /> if (!x-&gt;calg) {<br /> err = -ENOMEM;<br /> goto out;<br /> }<br /> strcpy(x-&gt;calg-&gt;alg_name, a-&gt;name);<br /> x-&gt;props.calgo = sa-&gt;sadb_sa_encrypt;<br /> <br /> Unlike the authentication (x-&gt;aalg) and encryption (x-&gt;ealg) branches of<br /> the same function, the compression branch never initializes<br /> calg-&gt;alg_key_len. IPComp carries no key and the allocation only<br /> reserves sizeof(struct xfrm_algo) (i.e. no room for a key), so the field<br /> is left containing uninitialized slab data.<br /> <br /> calg-&gt;alg_key_len is later used as a length by xfrm_algo_clone() when an<br /> IPComp state is cloned during XFRM_MSG_MIGRATE:<br /> <br /> xfrm_state_migrate()<br /> xfrm_state_clone_and_setup()<br /> x-&gt;calg = xfrm_algo_clone(orig-&gt;calg);<br /> kmemdup(orig, xfrm_alg_len(orig));<br /> <br /> where xfrm_alg_len() returns sizeof(*alg) + (alg_key_len + 7) / 8. With<br /> a non-zero garbage alg_key_len, kmemdup() reads past the end of the<br /> 68-byte calg object. Adding an IPComp SA via PF_KEY and then migrating<br /> it triggers (net-next, KASAN, init_on_alloc=0):<br /> <br /> BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x44/0x60<br /> Read of size 4164 at addr ff11000025a74980 by task diag2/9287<br /> CPU: 3 UID: 0 PID: 9287 Comm: diag2 7.1.0-rc6-g903db046d557 #1<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x10e/0x1f0<br /> print_report+0xf7/0x600<br /> kasan_report+0xe4/0x120<br /> kasan_check_range+0x105/0x1b0<br /> __asan_memcpy+0x23/0x60<br /> kmemdup_noprof+0x44/0x60<br /> xfrm_state_migrate+0x70a/0x1da0<br /> xfrm_migrate+0x753/0x18a0<br /> xfrm_do_migrate+0xb47/0xf10<br /> xfrm_user_rcv_msg+0x411/0xb50<br /> netlink_rcv_skb+0x158/0x420<br /> xfrm_netlink_rcv+0x71/0x90<br /> netlink_unicast+0x584/0x850<br /> netlink_sendmsg+0x8b0/0xdc0<br /> ____sys_sendmsg+0x9f7/0xb90<br /> ___sys_sendmsg+0x134/0x1d0<br /> __sys_sendmsg+0x16d/0x220<br /> do_syscall_64+0x116/0x7d0<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> <br /> Allocated by task 9287:<br /> kasan_save_stack+0x33/0x60<br /> kasan_save_track+0x14/0x30<br /> __kasan_kmalloc+0xaa/0xb0<br /> pfkey_add+0x2652/0x2ea0<br /> pfkey_process+0x6d0/0x830<br /> pfkey_sendmsg+0x42c/0x850<br /> __sys_sendto+0x461/0x4b0<br /> __x64_sys_sendto+0xe0/0x1c0<br /> do_syscall_64+0x116/0x7d0<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> The buggy address belongs to the object at ff11000025a74980<br /> which belongs to the cache kmalloc-96 of size 96<br /> The buggy address is located 0 bytes inside of<br /> allocated 68-byte region [ff11000025a74980, ff11000025a749c4)<br /> <br /> Depending on the uninitialized value the same field can instead request<br /> an oversized kmemdup() allocation and make the migration clone fail.<br /> <br /> The XFRM netlink path is not affected: verify_one_alg() rejects an<br /> XFRMA_ALG_COMP attribute shorter than xfrm_alg_len(), so a calg added via<br /> XFRM_MSG_NEWSA is always self-consistent.<br /> <br /> Initialize calg-&gt;alg_key_len to 0, matching the aalg/ealg branches.