CVE-2026-43078

A flaw was found in the Linux kernel. Specifically, within the crypto: af_alg component, a page reassignment overflow could occur in the af_alg_pull_tsgl function. This vulnerability arises because the original loop was not updated, potentially allowing it to reassign one more page than necessary. This could lead to unexpected system behavior or a denial of service (DoS).

af_alg_pull_tsgl can reassign one extra page into the destination scatterlist because the reassignment path did not check whether plen is non zero. A local process using AF_ALG crypto sockets can craft buffer and scatterlist state so the function advances the destination index for a zero length fragment, which can overrun the caller allocated dst SG entries. For the CVSS the PR:L is used because triggering requires local code execution through the AF_ALG socket API, but not administrator privileges in typical configurations. The issue is not network reachable because the vulnerable input is a local crypto socket operation. Impact is at least local denial of service via kernel crash. In the paranoid case, the destination scatterlist overwrite is treated as a plausible memory corruption primitive with possible confidentiality and integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.