CVE-2026-68125
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In the Linux kernel mac802154 llsec subsystem, missing validation of frame length relative to authentication tag length leads to passing a huge value to AEAD and out-of-bounds read. The fix rejects frames shorter than the tag.
Risk Assessment
An attacker within radio range can send a specially crafted frame, causing a kernel crash or potential code execution.
Recommendation
Apply the Linux kernel update with the fix for CVE-2026-68125. Limit the range of 802.15.4 networks and monitor traffic.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame whose payload is shorter than the tag makes datalen - authlen negative; assoclen is then passed to aead_request_set_ad() as an unsigned value close to 4 GiB, so crypto_aead_decrypt() walks far off the end of the scatterlist that only spans the real frame. The frame is fully attacker-controlled and reaches this path from any IEEE 802.15.4 peer in radio range. Reject frames whose payload is shorter than the authentication tag before the subtraction. Dynamically reproduced on a KASAN kernel as a general-protection-fault in the AEAD scatterwalk, and the fix confirmed.