CVE-2026-43043 crypto: af-alg - fix NULL pointer dereference in scatterwalk
A local attacker can trigger a kernel panic via a specific sequence of sendmsg calls in the AF_ALG interface, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43043?
CVE-2026-43043 is a medium-severity vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: af-alg - fix NULL pointer dereference in scatterwalk
The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent sendmsg() allocates a new SGL and chains it, but fails to clear the end marker on the previous SGL's last data entry.
This causes the crypto scatterwalk to hit a premature end, returning NULL on sg_next() and leading to a kernel panic during dereference.
Fix this by explicitly unmarking the end of the previous SGL when performing sg_chain() in af_alg_alloc_tsgl().
Weakness: CWE-476
Which versions are affected by CVE-2026-43043?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43043?
Apply the vendor's patch.
Is CVE-2026-43043 being exploited?
There is no known exploitation of CVE-2026-43043 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43043, DEBIAN-CVE-2026-43043, GHSA-87mg-5j2r-6p32, ROOT-OS-DEBIAN-11-CVE-2026-43043, ROOT-OS-UBUNTU-2204-CVE-2026-43043, ROOT-OS-UBUNTU-2404-CVE-2026-43043 and 1 more.