CoreCVE
Back

HIGH

crypto: seqiv - Handle EBUSY correctly

Published Sep 18, 2025

Description

As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request.

However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.

Affected products

Remediation

Red Hat statement

The flaw is in the seqiv IV generator and can lead to a use-after-free when backlogged crypto requests return -EBUSY. Triggering it is easier locally by flooding the kernel crypto API (e.g. via AF_ALG or many concurrent AEAD requests) because the attacker must create backlog conditions. Remote triggering is much harder and only realistic for specific configurations (for example an in-kernel IPsec/TLS path that uses seqiv for AEAD). In practice this means an unprivileged local user with access to the kernel crypto interface is the most likely threat vector, while a remote attacker would need the target to both use seqiv and be inducible into heavy crypto backlog.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-416

Use After Free

References (14)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Linux
Published Sep 18, 2025
Updated Aug 5, 2026
Reserved Sep 17, 2025
Link CVE-2023-53373

CISA Vulnrichment

Updated Jan 14, 2026

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2023-53373

Red Hat

Severity Moderate
Public date Sep 18, 2025
Bugzilla 2396379
Link CVE-2023-53373

ENISA EUVD

Assigner Linux
Published Sep 18, 2025
Updated Aug 5, 2026
Link EUVD-2025-29968

GitHub

No data