CVE-2025-68726
In the Linux kernel, the following vulnerability has been resolved: crypto: aead - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize fie...
Affects 0 products across 4 vendors.
A vulnerability in the Linux kernel's crypto subsystem, specifically in the aead (Authenticated Encryption with Associated Data) module, has been identified and resolved. The issue pertains to the handling of the reqsize field in the crypto_alg structure, which was introduced to replace type-specific reqsize fields.
BSID: BS-2025-GLOBAL-030392-I • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-68726?
What is the CVSS score for CVE-2025-68726?
Is CVE-2025-68726 actively exploited?
How do I remediate CVE-2025-68726?
What systems are affected by CVE-2025-68726?
| CVE ID | CVE-2025-68726 |
|---|---|
| BSID | BS-2025-GLOBAL-030392-I BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2025-12-24 |
| Last Modified | 2026-07-30 |
| ICS Relevance | 0% |
| Domains | |
| Source | NVD |
In the Linux kernel, the following vulnerability has been resolved: crypto: aead - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fields. It looks like this was introduced specifically for ahash and acomp from the commit description as subsequent commits add necessary changes in these alg frameworks. However, this is being recommended for use in all crypto algs instead of setting reqsize using crypto_*_set_reqsize(). Using cra_reqsize in aead algorithms, hence, causes memory corruptions and crashes as the underlying functions in the algorithm framework have not been updated to set the reqsize properly from cra_reqsize. [1] Add proper set_reqsize calls in the aead init function to properly initialize reqsize for these algorithms in the framework. [1]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b
Source: NIST NVD / MITRE CVE Database
The vulnerability could potentially allow an attacker to exploit improper handling of the reqsize field, leading to memory corruption or other unspecified impacts. However, the exact attack vector and potential impact are not fully detailed in the provided information.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Fixed Version |
|---|---|---|
| Crypto | — | — |
| Github | — | — |
| Kernel | — | — |
| Linux | — | — |
No patch URL on record. Monitor vendor security advisories directly.
| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
SAGE Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 28d5c3a52c41cbe571f492607822ac9473808f24a9457834c94e8c94117f4bad4bbb39e9d07bc70b2e09ded0c787a1c3301aee81ac3c8a9f35c56385ad8d68e4 |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Check Your Assets Free →