Description
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an error causes af_alg_sendmsg to abort, ctx->merge may contain a garbage value from the previous loop. This may then trigger a crash on the next entry into af_alg_sendmsg when it attempts to do a merge that can't be done. Fix this by setting ctx->merge to zero near the start of the loop.
References (5)
Scores
CVSS v3
5.5
EPSS
0.0002
EPSS Percentile
6.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-908
Status
published
Products (18)
linux/Kernel
2.6.38 - 6.1.154linux
linux/Kernel
6.13.0 - 6.16.9linux
linux/Kernel
6.2.0 - 6.6.108linux
linux/Kernel
6.7.0 - 6.12.49linux
Linux/Linux
< 2.6.38
Linux/Linux
2.6.38
Linux/Linux
6.1.154 - 6.1.*
Linux/Linux
6.12.49 - 6.12.*
Linux/Linux
6.16.9 - 6.16.*
Linux/Linux
6.17
... and 8 more
Published
Oct 04, 2025
Tracked Since
Feb 18, 2026