Critical Vulnerability in Linux Package: Boolean Misassignment in af_alg Context
Summary
DEBIAN-CVE-2025-40022: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") change... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential functionalities such as process management, memory management, and hardware abstraction. It is widely used in various distributions, including Debian. The kernel's robustness is vital for system stability and security. However, vulnerabilities can arise, impacting the integrity and reliability of the system. This specific vulnerability affects the Linux package across multiple Debian versions, highlighting the importance of timely updates and security patches.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the af_alg context where boolean values were incorrectly assigned due to a change in data type from bool to 1-bit bitfields of type u32. This change, introduced by commit 1b34cbbf4f01, led to situations where values greater than 1 were assigned to fields 'more' and 'merge'. The implicit conversion in C, which treats zero as false and nonzero as true, was disrupted, causing unintended assignments. This flaw could lead to unpredictable behavior in cryptographic operations, potentially compromising system security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The vulnerability identified in the Linux kernel's af_alg context poses significant risks due to incorrect boolean assignments. It is crucial for users to update their systems to the patched version to ensure security and stability. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves incorrect boolean assignments in the af_alg context of the Linux kernel, leading to potential security risks.
The vulnerability affects Debian versions 11, 12, 13, and 14.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Failure to address this vulnerability may lead to unpredictable behavior in cryptographic operations, potentially compromising system security and data integrity.
The most effective mitigation is to apply the patch as soon as it becomes available. Currently, no specific workarounds are recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
