CVE-2026-68125mac802154: llsec: reject frames shorter than the authentication tag
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame whose payload is shorter than the tag makes datalen - authlen negative; assoclen is then passed to aead_request_set_ad() as an unsigned value close to 4 GiB, so crypto_aead_decrypt() walks far off the end of the scatterlist that only spans the real frame. The frame is fully attacker-controlled and reaches this path from any IEEE 802.15.4 peer in radio range. Reject frames whose payload is shorter than the authentication tag before the subtraction. Dynamically reproduced on a KASAN kernel as a general-protection-fault in the AEAD scatterwalk, and the fix confirmed.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4c14a2fb5d143e4ed94143be2b8c1961b47df9af before f27ce82eb04960465df71634b196a48a4ecafd50; 4c14a2fb5d143e4ed94143be2b8c1961b47df9af builds before 2d6b42a61373144298070668fddf06efe79cf2ff; from 4c14a2fb5d143e4ed94143be2b8c1961b47df9af before ec7e62d77193131227df49d654d118fdf5a59892; from 4c14a2fb5d143e4ed94143be2b8c1961b47df9af before 5bbf0cd9b6a7076af86c75e87e180099be2e11ae; from 4c14a2fb5d143e4ed94143be2b8c1961b47df9af before de80808f37d99c6dc67bb6f97eea00c8f57a8821; from 4c14a2fb5d143e4ed94143be2b8c1961b47df9af before f20dedce0429b293d4bad604e0d3f65d8ac96c83; from 4c14a2fb5d143e4ed94143be2b8c1961b47df9af before e09e0301d616c1ef38a5e64e8e4326fd39df13cc; from 4c14a2fb5d143e4ed94143be2b8c1961b47df9af before fd3a3f28ed60c6af4b2a39933b151d6b27842c3b | CNA record |
References
- https://git.kernel.org/stable/c/f27ce82eb04960465df71634b196a48a4ecafd50
- https://git.kernel.org/stable/c/2d6b42a61373144298070668fddf06efe79cf2ff
- https://git.kernel.org/stable/c/ec7e62d77193131227df49d654d118fdf5a59892
- https://git.kernel.org/stable/c/5bbf0cd9b6a7076af86c75e87e180099be2e11ae
- https://git.kernel.org/stable/c/de80808f37d99c6dc67bb6f97eea00c8f57a8821
- https://git.kernel.org/stable/c/f20dedce0429b293d4bad604e0d3f65d8ac96c83
- https://git.kernel.org/stable/c/e09e0301d616c1ef38a5e64e8e4326fd39df13cc
- https://git.kernel.org/stable/c/fd3a3f28ed60c6af4b2a39933b151d6b27842c3b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.