NetSight
IP …
high7.5

CVE-2025-71131

In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encrypt…

Impact

In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid. Instead of checking req->iv against info, create a new variable unaligned_info and use it for that purpose instead.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.25.1 before 5.10.248
from 5.11 before 5.15.198
from 5.16 before 6.1.160
from 6.2 before 6.6.120
from 6.7 before 6.12.64
from 6.13 before 6.18.4

Weakness classification

CWE-416

References