LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43033: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption

In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption When decrypting data that is not in-place (src != dst), there is no need to save the high-order sequence bits in dst as it could simply be re-copied from the source. However, the data to be hashed need to be rearranged accordingly. Thanks,

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux kernel’s authenticated-encryption sequence-number handling can expose confidentiality, integrity, and availability when a specific out-of-place decryption path is used. Exploitation is local and requires low privileges, so internet exposure alone does not establish vulnerability. Exact distribution package status requires vendor confirmation.

Executive priority

Treat this as a high-priority kernel update, especially on systems permitting untrusted local users or workloads. It is not documented as remotely exploitable or actively exploited. Use normal emergency-change governance based on local-access likelihood, workload dependence, and vendor confirmation rather than assuming every Linux system is immediately exposed.

Technical view

The authencesn implementation incorrectly placed high-order sequence bits at the end of the destination buffer during out-of-place decryption, where source and destination differ. The correction reuses those bits from the source and rearranges the authenticated data. CVSS 3.1 rates impact high across confidentiality, integrity, and availability, with local, low-privilege access required.

Likely exposure

Potentially exposed assets are systems running affected Linux kernels where workloads exercise authencesn out-of-place decryption. The supplied version entries span several kernel branches but are insufficient for dependable distribution-package mapping. Appliances and embedded products may inherit exposure, but only vendor advisories can confirm their status.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of active exploitation or public weaponization. The CVSS vector indicates a local attacker with low privileges, low complexity, and no user interaction. The sources do not establish how commonly the vulnerable decryption path is reachable.

Researcher notes

The source bundle describes the faulty buffer arrangement and corrective behavior but does not provide a CWE, crash trace, proof of concept, or detailed reachability analysis. The duplicated commit entry and unusual version data reduce confidence in exact affected-range interpretation. Review branch-specific commits and downstream advisories before declaring a build vulnerable or fixed.

Mitigation direction

  • Apply a vendor-supported kernel update that incorporates the applicable referenced stable fix.
  • Check Linux distribution and appliance advisories for package-specific fixed versions.
  • If patching is delayed, request vendor guidance; the supplied sources identify no verified workaround.
  • Prioritize shared, multi-user, container-hosting, and security-sensitive systems where local access is plausible.

Validation and detection

  • Inventory running kernel versions and vendor package revisions across Linux hosts and appliances.
  • Compare vendor changelogs or build provenance against the referenced stable fix commits.
  • Determine whether deployed configurations or workloads use authencesn and out-of-place decryption.
  • After updating, confirm the running kernel contains the vendor fix and retest dependent cryptographic workloads.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43033 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-43033Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux104880a6b470958ddc30e139c41aa4f6ed3a5234, 104880a6b470958ddc30e139c41aa4f6ed3a5234, 104880a6b470958ddc30e139c41aa4f6ed3a5234, 104880a6b470958ddc30e139c41aa4f6ed3a5234, 104880a6b470958ddc30e139c41aa4f6ed3a5234, 104880a6b470958ddc30e139c41aa4f6ed3a5234, 104880a6b470958ddc30e139c41aa4f6ed3a5234, 104880a6b470958ddc30e139c41aa4f6ed3a5234unaffected
LinuxLinux4.3, 0, 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.