CVE-2025-71131: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
In the Linux kernel, the following vulnerability has been resolved:
crypto: seqiv - Do not use req->iv after cryptoaeadencrypt
As soon as cryptoaeadencrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid.
Instead of checking req->iv against info, create a new variable unalignedinfo and use it for that purpose instead.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71131?
CVE-2025-71131 has a moderate severity rating due to potential information leaks in the kernel.
How do I fix CVE-2025-71131?
To fix CVE-2025-71131, update your Linux kernel to the latest stable version that contains the patch for this vulnerability.
What kind of systems are affected by CVE-2025-71131?
CVE-2025-71131 affects Linux kernel versions where the crypto subsystem implements asynchronous operations using req->iv improperly.
What are the potential risks of CVE-2025-71131?
The risks of CVE-2025-71131 include possible unauthorized access to sensitive data that may be exposed by the improper use of initialization vectors.
Is CVE-2025-71131 related to specific Linux kernel versions?
Yes, CVE-2025-71131 primarily affects certain versions of the Linux kernel that utilize the crypto_aead_encrypt function inappropriately.