Description
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer while RFC3686 skciphers expose an 8-byte IV, so the restore overruns the provided buffer. Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.
References (11)
Core 11
Core References
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-53016
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2492269
Scores
CVSS v3
7.8
EPSS
0.0013
EPSS Percentile
3.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-805
Status
published
Products (25)
linux/Kernel
3.14.0 - 5.10.258linux
linux/Kernel
5.11.0 - 5.15.209linux
linux/Kernel
5.16.0 - 6.1.175linux
linux/Kernel
6.13.0 - 6.18.33linux
linux/Kernel
6.19.0 - 7.0.10linux
linux/Kernel
6.2.0 - 6.6.141linux
linux/Kernel
6.7.0 - 6.12.91linux
Linux/Linux
< 3.14
Linux/Linux
2b789435d7f36ed918d92db647f3a2f3fec9bb1f - 227c1e1d9e2aa4cfc65ba446d5690da1f546cda4
Linux/Linux
2b789435d7f36ed918d92db647f3a2f3fec9bb1f - 798d409a8949f3f495f238549b86de2886b129bd
... and 15 more
Published
Jun 24, 2026
Tracked Since
Jun 24, 2026