{"id":"CVE-2025-71131","title":"crypto: seqiv - Do not use req->iv after crypto_aead_encrypt","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: seqiv - Do not use req->iv after crypto_aead_encrypt\n\nAs soon as crypto_aead_encrypt is called, the underlying request\nmay be freed by an asynchronous completio…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 18202537856e0fae079fed2c9308780bcff2bb9d","Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < baf0e2d1e03ddb04781dfe7f22a654d3611f69b2","Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 50f196d2bbaee4ab2494bb1b0d294deba292951a","Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 0279978adec6f1296af66b642cce641c6580be46","Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < ccbb96434d88e32358894c879457b33f7508e798","Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 5476f7f8a311236604b78fcc5b2a63b3a61b0169","Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 50fdb78b7c0bcc550910ef69c0984e751cac72fa","Linux 2.6.25"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:40:45.516602Z"},"published":"2026-01-14","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:44:01.897Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71131","references":[{"url":"https://git.kernel.org/stable/c/18202537856e0fae079fed2c9308780bcff2bb9d"},{"url":"https://git.kernel.org/stable/c/baf0e2d1e03ddb04781dfe7f22a654d3611f69b2"},{"url":"https://git.kernel.org/stable/c/50f196d2bbaee4ab2494bb1b0d294deba292951a"},{"url":"https://git.kernel.org/stable/c/0279978adec6f1296af66b642cce641c6580be46"},{"url":"https://git.kernel.org/stable/c/ccbb96434d88e32358894c879457b33f7508e798"},{"url":"https://git.kernel.org/stable/c/5476f7f8a311236604b78fcc5b2a63b3a61b0169"},{"url":"https://git.kernel.org/stable/c/50fdb78b7c0bcc550910ef69c0984e751cac72fa"}],"tags":["cve.org"],"epss":0.00279,"epssPercentile":0.20686,"ingestedAt":"2026-09-08T15:33:26.994Z","slug":"CVE-2025-71131","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: seqiv - Do not use req->iv after crypto_aead_encrypt\n\nAs soon as crypto_aead_encrypt is called, the underlying request\nmay be freed by an asynchronous completion.  Thus dereferencing\nreq->iv after it returns is invalid.\n\nInstead of checking req->iv against info, create a new variable\nunaligned_info and use it for that purpose instead.\n\n## Affected\n\n- `Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 18202537856e0fae079fed2c9308780bcff2bb9d`\n- `Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < baf0e2d1e03ddb04781dfe7f22a654d3611f69b2`\n- `Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 50f196d2bbaee4ab2494bb1b0d294deba292951a`\n- `Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 0279978adec6f1296af66b642cce641c6580be46`\n- `Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < ccbb96434d88e32358894c879457b33f7508e798`\n- `Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 5476f7f8a311236604b78fcc5b2a63b3a61b0169`\n- `Linux >= 0a270321dbf948963aeb0e8382fe17d2c2eb3771 < 50fdb78b7c0bcc550910ef69c0984e751cac72fa`\n- `Linux 2.6.25`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}