CVE-2026-74578: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74578 is a race condition vulnerability in the Linux kernel's crypto/algif_skcipher module that allows an unprivileged local user to manipulate the initialization vector (IV) of a concurrent encryption operation, enabling plaintext recovery. The flaw affects Linux kernel versions from 4.14 up to (but not including) the fixed stable releases: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. It was published on August 16, 2026, with patches referenced in the GitHub Advisory GHSA-fh4p-v6r7-6956. The vulnerability is estimated as Medium severity by Feedly's CVSS category estimate (GitHub Advisory).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (related to CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) in skcipher_recvmsg(). The AIO/async path passes the socket-wide ctx->iv pointer directly into the skcipher request; after io_submit() releases the socket lock, a concurrent sendmsg(ALG_SET_IV) call can overwrite ctx->iv, causing the in-flight request to execute under an attacker-controlled IV. For ciphers with statesize == 0 (including CBC and CTR), IV chaining between MSG_MORE chunks is carried solely by in-place req->iv writeback, making a simple snapshot of the IV into per-request storage insufficient. The fix forces synchronous processing in algif_skcipher.c, eliminating both the IV race and the writeback race, mirroring the upstream approach of commit fcc77d33a34c (GitHub Advisory).

Successful exploitation allows an unprivileged local user to recover the plaintext of data being encrypted concurrently by another thread or process on the same system. For CTR and other stream cipher modes, the attacker-controlled IV causes IV/keystream reuse, directly enabling plaintext recovery. The impact is primarily a confidentiality breach; integrity and availability are not directly affected. Testing on 6.6.y demonstrated attacker IV injection success rates of 2296 out of 200,000 attempts before the patch, dropping to 0 after (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). Exploitation requires local unprivileged access to the system and the ability to open AF_ALG sockets, which is available by default on most Linux distributions. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No EPSS score is currently available for this CVE.

1. Gain local access: Obtain an unprivileged shell on a target Linux system running a kernel version between 4.14 and the patched stable releases (e.g., before 6.6.145 on a 6.6.x system).
2. Open AF_ALG socket: Create an AF_ALG socket of type SOCK_SEQPACKET with algorithm type skcipher and a target cipher (e.g., AES-CTR or AES-CBC) using standard socket syscalls.
3. Set up concurrent encryption: In one thread, initiate an asynchronous encryption operation via io_submit() using skcipher_recvmsg(), which passes the socket-wide ctx->iv into the in-flight skcipher request and then releases the socket lock.
4. Race to overwrite IV: In a concurrent thread, immediately call sendmsg() with ALG_SET_IV to overwrite ctx->iv with an attacker-controlled value while the async request is still being processed.
5. Recover plaintext: Because the in-flight request now runs under the attacker-controlled IV, for CTR/stream modes this causes keystream reuse. By observing the ciphertext output and knowing the attacker-supplied IV, the plaintext of the concurrent operation can be recovered (GitHub Advisory).

Update the Linux kernel to a patched stable version: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 or later. The fix forces synchronous processing in crypto/algif_skcipher.c, eliminating the IV race condition. As a workaround where patching is not immediately possible, restrict access to AF_ALG socket creation using mandatory access control frameworks such as SELinux or AppArmor policies to limit which users can instantiate algif_skcipher sockets (GitHub Advisory).