CVE-2026-31739: crypto: tegra - Add missing CRYPTO_ALG_ASYNC
In the Linux kernel, the following vulnerability has been resolved:
crypto: tegra - Add missing CRYPTOALGASYNC
The tegra crypto driver failed to set the CRYPTOALGASYNC on its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This causes crashes (at least). Fix this by adding the flag like what the other drivers do. Also remove the unnecessary CRYPTOALGTYPE flags, since those just get ignored and overridden by the registration function anyway.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Adjust the tegra crypto driver flag handling by removing unnecessary CRYPTO_ALG_TYPE_* flags (per the note) and adding the missing CRYPTO_ALG_ASYNC flag so the crypto API registers asynchronous algorithms correctly, avoiding crashes.
Linux kernel (crypto: tegra driver) CRYPTO_ALG_ASYNC flags = Remove unnecessary CRYPTO_ALG_TYPE_* flags and ensure CRYPTO_ALG_ASYNC is set for the tegra crypto driver algorithms
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel Tegra crypto driver are relevant. The issue occurs when the crypto API selects the driver's asynchronous algorithms for callers that requested synchronous algorithms.
What does the supplied severity data indicate about exploitation requirements?
The CVSS vector rates the attack vector as network-based, attack complexity as low, required privileges as low, and user interaction as not required. It also rates confidentiality, integrity, and availability impact as high.
What is the observed impact if the vulnerable behavior is triggered?
The incorrect algorithm selection can cause crashes, at minimum. The supplied CVSS score also assesses high potential impact to confidentiality, integrity, and availability.