CVE-2026-46033 crypto: authencesn - reject short ahash digests during instance creation
A flaw in the Linux kernel's authencesn crypto module allows out-of-bounds access via short digests, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46033?
CVE-2026-46033 is a high-severity memory corruption vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: authencesn - reject short ahash digests during instance creation
authencesn requires either a zero authsize or an authsize of at least 4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of high-order sequence number data at the end of the authenticated data.
While crypto_authenc_esn_setauthsize() already rejects explicit non-zero authsizes in the range 1..3, crypto_authenc_esn_create() still copied auth->digestsize into inst->alg.maxauthsize without validating it. The AEAD core then initialized the tfm's default authsize from that value.
As a result, selecting an ahash with digest size 1..3, such as cbcmac(cipher_null), exposed authencesn instances whose default authsize was invalid even though setauthsize() would have rejected the same value. AF_ALG could then trigger the ESN tail handling with a too-short tag and hit an out-of-bounds access.
Reject authencesn instances whose ahash digest size is in the invalid non-zero range 1..3 so that no tfm can inherit an unsupported default authsize.
Which versions are affected by CVE-2026-46033?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46033?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-46033 being exploited?
There is no known exploitation of CVE-2026-46033 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88428, BELL-CVE-2026-46033, DEBIAN-CVE-2026-46033, GHSA-f7w2-rj2f-73q3, ROOT-OS-DEBIAN-11-CVE-2026-46033, ROOT-OS-DEBIAN-12-CVE-2026-46033 and 3 more.