---
id: CVE-2026-80843
title: 'xfrm: fix xfrm_state_construct() auth-trunc leak'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: fix xfrm_state_construct() auth-trunc leak

  attach_auth_trunc() can allocate x->aalg while leaving
  x->props.aalgo at zero when the selected auth algorithm has no
  …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 <
    958ae9f261319e1cdc44879886bcda2263258cca
  - >-
    Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 <
    fb7f3e74789a3c89647f4eb768f6dfaf4a751e72
  - >-
    Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 <
    ba0c110c205855b3f1e3130d8c0fdb484d704c8c
  - >-
    Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 <
    c8837bbe792257af547fd1c0252553ce13148795
  - >-
    Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 <
    71d42da01740ec6557837bebec0bc48cfc3b4c39
  - >-
    Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 <
    cf67361e78dca488d6e4df8396a53e6745a3a80e
  - >-
    Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 <
    37426395cb90ef217beec8407a14bd82153793d3
  - >-
    Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 <
    be19d20e53a239572bb2a28efcc1cd2b069b1ef9
  - >-
    Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 <
    c12cbf56320fb633484ee0ca1fb7d68d6b64b213
  - Linux 2.6.33
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:36.352Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80843'
references:
  - url: 'https://git.kernel.org/stable/c/958ae9f261319e1cdc44879886bcda2263258cca'
  - url: 'https://git.kernel.org/stable/c/fb7f3e74789a3c89647f4eb768f6dfaf4a751e72'
  - url: 'https://git.kernel.org/stable/c/ba0c110c205855b3f1e3130d8c0fdb484d704c8c'
  - url: 'https://git.kernel.org/stable/c/c8837bbe792257af547fd1c0252553ce13148795'
  - url: 'https://git.kernel.org/stable/c/71d42da01740ec6557837bebec0bc48cfc3b4c39'
  - url: 'https://git.kernel.org/stable/c/cf67361e78dca488d6e4df8396a53e6745a3a80e'
  - url: 'https://git.kernel.org/stable/c/37426395cb90ef217beec8407a14bd82153793d3'
  - url: 'https://git.kernel.org/stable/c/be19d20e53a239572bb2a28efcc1cd2b069b1ef9'
  - url: 'https://git.kernel.org/stable/c/c12cbf56320fb633484ee0ca1fb7d68d6b64b213'
tags:
  - cve.org
epss: 0.00195
epssPercentile: 0.08585
ingestedAt: '2026-10-19T09:16:01.497Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix xfrm_state_construct() auth-trunc leak

attach_auth_trunc() can allocate x->aalg while leaving
x->props.aalgo at zero when the selected auth algorithm has no
sadb_alg_id. One real case is cmac(aes).

xfrm_state_construct() then treats !x->props.aalgo as "no auth
algorithm attached yet" and calls attach_auth(). That overwrites
x->aalg and loses the first allocation. Any later failure or teardown
only frees the replacement pointer.

Check whether x->aalg is already attached instead of inferring that
state from x->props.aalgo.

## Affected

- `Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 < 958ae9f261319e1cdc44879886bcda2263258cca`
- `Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 < fb7f3e74789a3c89647f4eb768f6dfaf4a751e72`
- `Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 < ba0c110c205855b3f1e3130d8c0fdb484d704c8c`
- `Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 < c8837bbe792257af547fd1c0252553ce13148795`
- `Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 < 71d42da01740ec6557837bebec0bc48cfc3b4c39`
- `Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 < cf67361e78dca488d6e4df8396a53e6745a3a80e`
- `Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 < 37426395cb90ef217beec8407a14bd82153793d3`
- `Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 < be19d20e53a239572bb2a28efcc1cd2b069b1ef9`
- `Linux >= 4447bb33f09444920a8f1d89e1540137429351b6 < c12cbf56320fb633484ee0ca1fb7d68d6b64b213`
- `Linux 2.6.33`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.