Answer in brief
CVE-2026-68125 records a Unknown severity vulnerability in mac802154: llsec: reject frames shorter than the authentication tag. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <5bbf0cd9b6a7076af86c75e87e180099be2e11ae || >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <de80808f37d99c6dc67bb6f97eea00c8f57a8821 || >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <f20dedce0429b293d4bad604e0d3f65d8ac96c83 || >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <e09e0301d616c1ef38a5e64e8e4326fd39df13cc || >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <fd3a3f28ed60c6af4b2a39933b151d6b27842c3b | 5bbf0cd9b6a7076af86c75e87e180099be2e11ae, de80808f37d99c6dc67bb6f97eea00c8f57a8821, f20dedce0429b293d4bad604e0d3f65d8ac96c83, e09e0301d616c1ef38a5e64e8e4326fd39df13cc, fd3a3f28ed60c6af4b2a39933b151d6b27842c3b |
| Linux/Linuxgeneric | 3.16 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame whose payload is shorter than the tag makes datalen - authlen negative; assoclen is then passed to aead_request_set_ad() as an unsigned value close to 4 GiB, so crypto_aead_decrypt() walks far off the end of the scatterlist that only spans the real frame. The frame is fully attacker-controlled and reaches this path from any IEEE 802.15.4 peer in radio range. Reject frames whose payload is shorter than the authentication tag before the subtraction. Dynamically reproduced on a KASAN kernel as a general-protection-fault in the AEAD scatterwalk, and the fix confirmed.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68125 records a Unknown severity vulnerability in mac802154: llsec: reject frames shorter than the authentication tag. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <5bbf0cd9b6a7076af86c75e87e180099be2e11ae || >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <de80808f37d99c6dc67bb6f97eea00c8f57a8821 || >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <f20dedce0429b293d4bad604e0d3f65d8ac96c83 || >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <e09e0301d616c1ef38a5e64e8e4326fd39df13cc || >=4c14a2fb5d143e4ed94143be2b8c1961b47df9af <fd3a3f28ed60c6af4b2a39933b151d6b27842c3b | 5bbf0cd9b6a7076af86c75e87e180099be2e11ae, de80808f37d99c6dc67bb6f97eea00c8f57a8821, f20dedce0429b293d4bad604e0d3f65d8ac96c83, e09e0301d616c1ef38a5e64e8e4326fd39df13cc, fd3a3f28ed60c6af4b2a39933b151d6b27842c3b |
| Linux/Linuxgeneric | 3.16 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame whose payload is shorter than the tag makes datalen - authlen negative; assoclen is then passed to aead_request_set_ad() as an unsigned value close to 4 GiB, so crypto_aead_decrypt() walks far off the end of the scatterlist that only spans the real frame. The frame is fully attacker-controlled and reaches this path from any IEEE 802.15.4 peer in radio range. Reject frames whose payload is shorter than the authentication tag before the subtraction. Dynamically reproduced on a KASAN kernel as a general-protection-fault in the AEAD scatterwalk, and the fix confirmed.
Quoted source text, attributed separately from HOL analysis.