CVE-2026-68125: mac802154: llsec: reject frames shorter than the authentication tag
In the Linux kernel, the following vulnerability has been resolved:
mac802154: llsec: reject frames shorter than the authentication tag
llsecdodecryptauth() computes the associated-data length for the AEAD request as
assoclen += datalen - authlen;
where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame whose payload is shorter than the tag makes datalen - authlen negative; assoclen is then passed to aeadrequestsetad() as an unsigned value close to 4 GiB, so cryptoaeaddecrypt() walks far off the end of the scatterlist that only spans the real frame.
The frame is fully attacker-controlled and reaches this path from any IEEE 802.15.4 peer in radio range. Reject frames whose payload is shorter than the authentication tag before the subtraction.
Dynamically reproduced on a KASAN kernel as a general-protection-fault in the AEAD scatterwalk, and the fix confirmed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the vulnerability fix: in mac802154 llsec_do_decrypt_auth(), reject IEEE 802.15.4 secured frames when the payload length after the MAC header (datalen) is shorter than the authentication tag length (authlen), so the associated-data length computation never subtracts authlen from a smaller datalen.
Linux kernel (mac802154: llsec) Reject frames shorter than the authentication tag (authlen) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68125?
CVE-2026-68125 has a risk score of 62, indicating a medium severity vulnerability.
How do I fix CVE-2026-68125?
To fix CVE-2026-68125, update your Linux kernel to the latest version where this vulnerability is resolved.
What impact does CVE-2026-68125 have on my system?
CVE-2026-68125 can allow the acceptance of improperly formatted frames, potentially leading to unauthorized access to network communications.
Is CVE-2026-68125 a local or remote vulnerability?
CVE-2026-68125 is primarily a remote vulnerability, affecting network packet processing in the kernel.
Which versions of the Linux kernel are affected by CVE-2026-68125?
CVE-2026-68125 affects specific versions of the Linux kernel that utilize mac802154, particularly before the security fix was applied.