Loading vulnerability…
Use-after-free in Linux kernel crypto seqiv
CVE-2025-71131 is a use-after-free vulnerability in the Linux kernel's crypto seqiv implementation. Calling crypto_aead_encrypt() can trigger asynchronous completion that frees the underlying request before subsequent code accesses req->iv. Dereferencing this member after the encryption call returns can therefore access freed kernel memory and cause a denial of service. The fix uses a separate unaligned_info variable for the comparison with info, avoiding access to the potentially freed request.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause invalid kernel memory access, potentially crashing the kernel and denying service to workloads on the affected system. The published CVSS assessment assigns high availability impact and no confidentiality or integrity impact. Privilege escalation, arbitrary code execution, and information disclosure are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is established. Until patched kernels are deployed, restrict untrusted local access and exposure to workloads capable of invoking the affected kernel crypto operations. For affected Siemens devices, restrict interactive shell access to trusted personnel, run applications only from trusted sources, and apply the vendor's network-access protections. These measures reduce exposure but do not correct the use-after-free.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the crypto seqiv fix and reboot into the updated kernel. The code correction replaces the post-crypto_aead_encrypt() access to req->iv with use of a separate unaligned_info variable. Fixed distribution releases include Debian trixie linux 6.12.69-1 and bookworm linux 6.1.162-1; RHEL 9.6 EUS kernel 5.14.0-570.132.1.el9_6 under RHSA-2026:52667; and RHEL 10.0 EUS kernel 6.12.0-55.98.1.el10_0 under RHSA-2026:55445. Later vendor-supported builds containing the fix are also suitable. For affected Google COS branches, the listed fixed versions are 18613.439.108, 18867.294.100, and 19216.104.113, respectively; select the update matching the installed branch. Use the applicable SUSE security update for affected SUSE products. No fixed firmware is identified for affected Siemens devices in advisory SSA-457936 V1.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.