---
id: CVE-2026-43043
title: 'crypto: af-alg - fix NULL pointer dereference in scatterwalk'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: af-alg - fix NULL pointer dereference in scatterwalk

  The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)
  when chaining a new af_alg_tsg…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <
    f48d3dd99199180cf37d6253550c55e86372309a
  - >-
    Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <
    f9acceae7b004956851fd4268edf9f518a9bce04
  - >-
    Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <
    7195350fb78538c25cd790d703f8f2c73ee0d395
  - >-
    Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <
    7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49
  - >-
    Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <
    44eafa39363e8d5dfda6a8c6eb6b45458ed4b948
  - >-
    Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <
    00cbdec17c15d024a1c5002c7365df7624a18a75
  - >-
    Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <
    4b03ab0a587ec57eb7ddb5c115d84a42896f60f7
  - >-
    Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <
    62397b493e14107ae82d8b80938f293d95425bcb
  - Linux 2.6.38
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:27:04.710209Z'
published: '2026-05-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:28.084Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43043'
references:
  - url: 'https://git.kernel.org/stable/c/f48d3dd99199180cf37d6253550c55e86372309a'
  - url: 'https://git.kernel.org/stable/c/f9acceae7b004956851fd4268edf9f518a9bce04'
  - url: 'https://git.kernel.org/stable/c/7195350fb78538c25cd790d703f8f2c73ee0d395'
  - url: 'https://git.kernel.org/stable/c/7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49'
  - url: 'https://git.kernel.org/stable/c/44eafa39363e8d5dfda6a8c6eb6b45458ed4b948'
  - url: 'https://git.kernel.org/stable/c/00cbdec17c15d024a1c5002c7365df7624a18a75'
  - url: 'https://git.kernel.org/stable/c/4b03ab0a587ec57eb7ddb5c115d84a42896f60f7'
  - url: 'https://git.kernel.org/stable/c/62397b493e14107ae82d8b80938f293d95425bcb'
tags:
  - cve.org
epss: 0.00114
epssPercentile: 0.01499
ingestedAt: '2026-11-06T15:54:04.032Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: af-alg - fix NULL pointer dereference in scatterwalk

The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)
when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL
exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent
sendmsg() allocates a new SGL and chains it, but fails to clear the end
marker on the previous SGL's last data entry.

This causes the crypto scatterwalk to hit a premature end, returning NULL
on sg_next() and leading to a kernel panic during dereference.

Fix this by explicitly unmarking the end of the previous SGL when
performing sg_chain() in af_alg_alloc_tsgl().

## Affected

- `Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 < f48d3dd99199180cf37d6253550c55e86372309a`
- `Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 < f9acceae7b004956851fd4268edf9f518a9bce04`
- `Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 < 7195350fb78538c25cd790d703f8f2c73ee0d395`
- `Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 < 7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49`
- `Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 < 44eafa39363e8d5dfda6a8c6eb6b45458ed4b948`
- `Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 < 00cbdec17c15d024a1c5002c7365df7624a18a75`
- `Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 < 4b03ab0a587ec57eb7ddb5c115d84a42896f60f7`
- `Linux >= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 < 62397b493e14107ae82d8b80938f293d95425bcb`
- `Linux 2.6.38`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.