{"id":"CVE-2026-43077","title":"crypto: algif_aead - Fix minimum RX size check for decryption","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Fix minimum RX size check for decryption\n\nThe check for the minimum receive buffer size did not take the\ntag size into account during decryption.  …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 74a66fdb5282d89e348b00c42cfca3a936946d94","Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < fd427dd84f224309afbcc2cb67c7bb770a01265c","Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 1c76b5675119f694458293a2a81f40731c69bd32","Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < e86ab1e5661386a874fbb8551f0c04b8e9f8ad22","Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < af2fa2fbbced26129813274b8b3f7705f280e174","Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 78cea133daf721698876e56135049a96d39d610a","Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 3afdc15d6173614d7d834517d9b65e7aa5a08548","Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 3d14bd48e3a77091cbce637a12c2ae31b4a1687c","Linux 4.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:27:59.443474Z"},"published":"2026-05-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:30.174Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43077","references":[{"url":"https://git.kernel.org/stable/c/74a66fdb5282d89e348b00c42cfca3a936946d94"},{"url":"https://git.kernel.org/stable/c/fd427dd84f224309afbcc2cb67c7bb770a01265c"},{"url":"https://git.kernel.org/stable/c/1c76b5675119f694458293a2a81f40731c69bd32"},{"url":"https://git.kernel.org/stable/c/e86ab1e5661386a874fbb8551f0c04b8e9f8ad22"},{"url":"https://git.kernel.org/stable/c/af2fa2fbbced26129813274b8b3f7705f280e174"},{"url":"https://git.kernel.org/stable/c/78cea133daf721698876e56135049a96d39d610a"},{"url":"https://git.kernel.org/stable/c/3afdc15d6173614d7d834517d9b65e7aa5a08548"},{"url":"https://git.kernel.org/stable/c/3d14bd48e3a77091cbce637a12c2ae31b4a1687c"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02028,"ingestedAt":"2026-11-06T15:54:04.025Z","slug":"CVE-2026-43077","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Fix minimum RX size check for decryption\n\nThe check for the minimum receive buffer size did not take the\ntag size into account during decryption.  Fix this by adding the\nrequired extra length.\n\n## Affected\n\n- `Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 74a66fdb5282d89e348b00c42cfca3a936946d94`\n- `Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < fd427dd84f224309afbcc2cb67c7bb770a01265c`\n- `Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 1c76b5675119f694458293a2a81f40731c69bd32`\n- `Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < e86ab1e5661386a874fbb8551f0c04b8e9f8ad22`\n- `Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < af2fa2fbbced26129813274b8b3f7705f280e174`\n- `Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 78cea133daf721698876e56135049a96d39d610a`\n- `Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 3afdc15d6173614d7d834517d9b65e7aa5a08548`\n- `Linux >= d887c52d6ae43aeebd249b5f2f1333e60236aa60 < 3d14bd48e3a77091cbce637a12c2ae31b4a1687c`\n- `Linux 4.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}