CVE-2026-80843 xfrm: fix xfrm_state_construct() auth-trunc leak
A memory leak in the Linux kernel's xfrm subsystem allows attackers to cause denial of service or potentially read sensitive memory via crafted network packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80843?
CVE-2026-80843 is a memory corruption vulnerability in Linux, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix xfrm_state_construct() auth-trunc leak
attach_auth_trunc() can allocate x->aalg while leaving x->props.aalgo at zero when the selected auth algorithm has no sadb_alg_id. One real case is cmac(aes).
xfrm_state_construct() then treats !x->props.aalgo as "no auth algorithm attached yet" and calls attach_auth(). That overwrites x->aalg and loses the first allocation. Any later failure or teardown only frees the replacement pointer.
Check whether x->aalg is already attached instead of inferring that state from x->props.aalgo.
Which versions are affected by CVE-2026-80843?
How do I fix CVE-2026-80843?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-80843 being exploited?
There is no known exploitation of CVE-2026-80843 in the wild and no public exploit code.
Sources
Also known as AZL-99422, BELL-CVE-2026-80843, DEBIAN-CVE-2026-80843, GHSA-7vv6-3xqc-jr7v, UBUNTU-CVE-2026-80843.