Към съдържанието
Търсене

CVE-2026-98805: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix (a per-key salt XOR the peer's address) followed by a 64-bit counter. That counter is stored in the peer's RX crypto object. When the peer reports a change in which key it uses to receive packets, TIPC resets this counter. The sender can still be using the same TX key and salt, so subsequent packets reuse earlier nonces. This nonce reuse breaks confidentiality and exposes GCM's authentication key. This makes forgeries trivial: an attacker can exploit CTR malleability to alter captured ciphertexts and use the recovered authentication key to compute a valid tag for the modified ciphertext, under the same key and nonce. Use the TX key's existing aead->seqno counter instead. All encryptions using that key object share the same atomic counter, so concurrent encryptions get distinct nonce counter values. The counter survives key activation and peer reconnection, and peer key-status reports cannot reset it. This prevents those transitions from causing nonce reuse while the same TX key remains installed. The nonce format is unchanged, and receivers do not require consecutive counter values, so sharing the counter across peers remains compatible with existing receivers. A pre-existing check still invokes key revocation in the unlikely event that the counter wraps to zero.

    Засегнати продукти

    • Linux Linux: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 04d67f77fe3f9ec9c60db70773fb1696d0d58da8; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 7e5d5ac25e0857548cac963a2f850b19b2e1d59c; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 0ff0ca5b514ceecad68b8682e072f373acc5acec; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди a85a3dce4b6c73ddaa1e9725b906249744bf7cf2; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 5c8ce13c792e28d56f9ec3cd6728d8225bc0e3a2; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди f74f100e49588c1dbdc6ab3ba9e2c67b36d015d0; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 60e0c2aeaa605ff19ca4e65126a35643d4d7ee1c; fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 преди 512ccd3d0e91e791fb37442aa0a2599aca19783d
    • Linux Linux: 5.5; преди 5.5; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.113 до 6.12.*; 6.18.56 до 6.18.*; 7.2.10 до 7.2.*; от 7.3 нататък

    История

    • 18 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98805: Linux | freedomonline.bg