# CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state

> An attacker can exploit a race condition in the Linux kernel's AF_ALG interface to recover plaintext from concurrent cryptographic operations.

- **Severity:** High 7.1 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 16 Aug 2026
- **Updated:** 16 Oct 2026
- **Also known as:** BELL-CVE-2026-74578, DEBIAN-CVE-2026-74578, GHSA-fh4p-v6r7-6956, UBUNTU-CVE-2026-74578

## What is CVE-2026-74578?

CVE-2026-74578 is a high-severity vulnerability in Linux, published on 16 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_skcipher - force synchronous processing on trees without ctx->state

The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv
directly into the skcipher request. After io_submit() the socket lock is
dropped and the request is processed asynchronously, so a concurrent
sendmsg(ALG_SET_IV) can overwrite ctx->iv and make the in-flight request
run under an attacker-controlled IV. For CTR/stream modes this is
IV/keystream reuse and lets an unprivileged user recover the plaintext of
a concurrent operation.

Snapshotting ctx->iv into per-request storage for the async path is not
sufficient. For ciphers with statesize == 0 - which includes cbc and ctr -
the MSG_MORE inter-chunk IV chaining is carried solely by the in-place
req->iv writeback, which a snapshot redirects into per-request memory that
af_alg_free_resources() releases on completion, silently producing wrong
output. Writing the IV back from the completion callback instead is not
possible either: that would require lock_sock() there, but the callback can
run in softirq/atomic context, so it must not sleep.

Make the operation synchronous instead, which removes both the IV race and
any writeback race. This is equivalent to the upstream resolution, commit
fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the
AIO socket path across net/ entirely and so produces the same end state for
this file. This patch deviates from that commit deliberately: rather than
removing AIO socket support tree-wide, which would be far too invasive for
stable, it removes only the AIO branch in crypto/algif_skcipher.c.
io_submit() now completes synchronously; AF_ALG async is rarely used in
practice.

The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,
and is left alone to keep the fix minimal.

Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000
after the change; MSG_MORE chunked CTR output bit-identical to single-shot.

## Which versions are affected by CVE-2026-74578?


## How do I fix CVE-2026-74578?

Apply the vendor's patch.

## Is CVE-2026-74578 being exploited?

There is no known exploitation of CVE-2026-74578 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-74578 and fix it if it is affected.

What it is: CVE-2026-74578 is a high-severity vulnerability in Linux, published on 16 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-74578 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-74578/ (Markdown: https://insights.sbomify.com/CVE-2026-74578/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-74578
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74578
- OSV: https://osv.dev/vulnerability/CVE-2026-74578

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-74578/
Summaries are generated and may contain mistakes; the official description above is the record.