In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - copy IV using skcipher ivsize

AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.

ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV
buffer while RFC3686 skciphers expose an 8-byte IV, so the restore
overruns the provided buffer.

Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
2b789435d7f36ed918d92db647f3a2f3fec9bb1f affected < 939061b2d0f7f15114e34b4ce878ef50ff4089c3
2b789435d7f36ed918d92db647f3a2f3fec9bb1f affected < 798d409a8949f3f495f238549b86de2886b129bd
2b789435d7f36ed918d92db647f3a2f3fec9bb1f affected < dfb2cf434829819268fe50f41542aad318ad62b2
2b789435d7f36ed918d92db647f3a2f3fec9bb1f affected < eecee15e263ccb8cd77170a56ab6c969cb54dd6a
2b789435d7f36ed918d92db647f3a2f3fec9bb1f affected < bb01d8f1f385bc9034ca114d3508c7fdea24fc9a
2b789435d7f36ed918d92db647f3a2f3fec9bb1f affected < df9784bb5b637ac80f4a2768a58ca9a50bef28a9
2b789435d7f36ed918d92db647f3a2f3fec9bb1f affected < 227c1e1d9e2aa4cfc65ba446d5690da1f546cda4
2b789435d7f36ed918d92db647f3a2f3fec9bb1f affected < a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4
Linux Linux affected
Version Status Constraints
3.14 affected —
0 unaffected < 3.14
5.10.258 unaffected ≤ 5.10.*
5.15.209 unaffected ≤ 5.15.*
6.1.175 unaffected ≤ 6.1.*
6.6.141 unaffected ≤ 6.6.*
6.12.91 unaffected ≤ 6.12.*
6.18.33 unaffected ≤ 6.18.*
7.0.10 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/227c1e1d9e2aa4cfc65ba446d5690da1f546cda4 cve-icon
https://git.kernel.org/stable/c/798d409a8949f3f495f238549b86de2886b129bd cve-icon
https://git.kernel.org/stable/c/939061b2d0f7f15114e34b4ce878ef50ff4089c3 cve-icon
https://git.kernel.org/stable/c/a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4 cve-icon
https://git.kernel.org/stable/c/bb01d8f1f385bc9034ca114d3508c7fdea24fc9a cve-icon
https://git.kernel.org/stable/c/df9784bb5b637ac80f4a2768a58ca9a50bef28a9 cve-icon
https://git.kernel.org/stable/c/dfb2cf434829819268fe50f41542aad318ad62b2 cve-icon
https://git.kernel.org/stable/c/eecee15e263ccb8cd77170a56ab6c969cb54dd6a cve-icon
History

Wed, 24 Jun 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120

Wed, 24 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer while RFC3686 skciphers expose an 8-byte IV, so the restore overruns the provided buffer. Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.
Title crypto: ccp - copy IV using skcipher ivsize
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-24T16:29:26.272Z

Reserved: 2026-06-09T07:44:35.378Z

Link: CVE-2026-53016

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T19:00:06Z

Weaknesses