CVE-2025-71131

A use-after-free vulnerability was found in the Linux kernel's seqiv (Sequence IV) crypto module. After calling crypto_aead_encrypt(), the underlying request may be freed by asynchronous completion handlers. The code then incorrectly dereferences req->iv to compare against info, accessing potentially freed memory. This can cause memory corruption or crashes when using asynchronous AEAD encryption.

This vulnerability affects systems using the seqiv IV generator with asynchronous AEAD encryption algorithms. The race condition occurs when the encryption completes asynchronously before the calling code finishes examining the request structure. The use-after-free can cause kernel crashes or unpredictable behavior during cryptographic operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.