CVE-2025-71131: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid. Instead of checking req->iv against info, create a new variable unaligned_info and use it for that purpose instead.

Affected products

• Linux Linux Kernel: from 2.6.25.1, before 5.10.248 (fixed in 5.10.248); from 5.11, before 5.15.198 (fixed in 5.15.198); from 5.16, before 6.1.160 (fixed in 6.1.160); from 6.2, before 6.6.120 (fixed in 6.6.120); from 6.7, before 6.12.64 (fixed in 6.12.64); from 6.13, before 6.18.4 (fixed in 6.18.4); …

Published 2026-01-14. Last modified 2026-07-30.