High severity · published Jun 24, 2026
CVE-2026-53016
crypto: ccp - copy IV using skcipher ivsize
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - copy IV using skcipher ivsize
AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.
ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV
buffer while RFC3686 skciphers expose an 8-byte IV, so the restore
overruns the provided buffer.
Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
3.14 before 5.10.258; 5.11 before 5.15.209; 5.16 before 6.1.175; 6.2 before 6.6.141; 6.7 before 6.12.91; 6.13 before 6.18.33; +1 more · source: NVD
LI
Linux · Linux
2b789435d7f36ed918d92db647f3a2f3fec9bb1f before 939061b2d0f7f15114e34b4ce878ef50ff4089c3; 2b789435d7f36ed918d92db647f3a2f3fec9bb1f before 798d409a8949f3f495f238549b86de2886b129bd; 2b789435d7f36ed918d92db647f3a2f3fec9bb1f before dfb2cf434829819268fe50f41542aad318ad62b2; 2b789435d7f36ed918d92db647f3a2f3fec9bb1f before eecee15e263ccb8cd77170a56ab6c969cb54dd6a; 2b789435d7f36ed918d92db647f3a2f3fec9bb1f before bb01d8f1f385bc9034ca114d3508c7fdea24fc9a; 2b789435d7f36ed918d92db647f3a2f3fec9bb1f before df9784bb5b637ac80f4a2768a58ca9a50bef28a9; +3 more · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53016
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53016
Patch
https://git.kernel.org/stable/c/227c1e1d9e2aa4cfc65ba446d5690da1f546cda4
Patch
https://git.kernel.org/stable/c/798d409a8949f3f495f238549b86de2886b129bd
Patch
https://git.kernel.org/stable/c/939061b2d0f7f15114e34b4ce878ef50ff4089c3
Patch
https://git.kernel.org/stable/c/a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4
Patch
https://git.kernel.org/stable/c/bb01d8f1f385bc9034ca114d3508c7fdea24fc9a
Patch
https://git.kernel.org/stable/c/df9784bb5b637ac80f4a2768a58ca9a50bef28a9
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability