CVE-2026-23060: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23060 is a NULL pointer dereference vulnerability in the Linux kernel's authencesn cryptographic module, specifically in the crypto_authenc_esn_decrypt() function. When the Associated Authenticated Data (AAD) length (assoclen) is shorter than the minimum 8 bytes required by the ESP/ESN specification, the function can advance past the end of the destination scatterlist and trigger a NULL pointer dereference in scatterwalk_map_and_copy(), leading to a kernel panic (Denial of Service). The vulnerability affects Linux kernel versions from 4.3 through multiple stable branches, with fixed versions available across all affected series. It was published on February 4, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference), arising from missing input validation in the crypto_authenc_esn_decrypt() function within the kernel's authencesn module. The module assumes ESP/ESN-formatted AAD with a minimum length of 8 bytes; when a caller supplies an assoclen value below this threshold, the function incorrectly advances a pointer past the end of the destination scatterlist. This triggers a NULL pointer dereference inside scatterwalk_map_and_copy(), causing an immediate kernel panic. The fix adds a minimum AAD length check at the start of the decryption path to fail fast on invalid inputs, preventing the out-of-bounds scatterlist traversal (Feedly, Kernel Patch).

Successful exploitation results in a kernel panic, causing an immediate system crash and complete loss of availability for the affected host. The impact is limited to Denial of Service — there is no confidentiality or integrity impact, as the crash occurs before any sensitive data can be accessed or modified. Systems where local users have access to cryptographic interfaces (e.g., via IPsec/ESP with ESN) are at risk of service disruption, but lateral movement or data exfiltration are not direct consequences of this vulnerability (Feedly).

• Logs: Unexpected kernel panic messages in /var/log/kern.log or dmesg output referencing scatterwalk_map_and_copy() or crypto_authenc_esn_decrypt() with a NULL pointer dereference call trace.
• System Behavior: Sudden, unexplained system reboots or kernel oops events on hosts running IPsec with ESN (Extended Sequence Numbers) enabled.
• Crash Dumps: Kernel crash dumps (e.g., via kdump) showing a stack trace involving authencesn and scatterwalk functions.

Apply the appropriate kernel update for your distribution and kernel branch. Fixed upstream versions are: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7 or later. Major distributions including Ubuntu (USN-8145-1 and related), SUSE, Oracle Linux, Amazon Linux 2, and Red Hat (RHSA-2026:19074, RHSA-2026:19225) have issued updated packages. As a workaround where patching is not immediately possible, restrict local user access to cryptographic interfaces and avoid exposing IPsec/ESP with ESN to untrusted local users (Feedly, Kernel Patch).