Linux Kernel Async Crypto IV Race Condition Exploitation

CVE-2026-74578 is a race condition in the Linux kernel's cryptographic socket interface (algif_skcipher) where concurrent operations can manipulate initialization vectors (IVs) during asynchronous encryption processing. When an application uses AIO/async mode for symmetric cipher operations, the socket lock is released after submitting a request, allowing a malicious actor to overwrite the ctx->iv parameter via sendmsg(ALG_SET_IV) while the original request is still in flight. This forces the in-flight cryptographic operation to execute under an attacker-controlled IV, fundamentally compromising the security of stream ciphers like CTR mode. This vulnerability affects any Linux system running vulnerable kernel versions where applications rely on the AF_ALG socket interface for cryptographic operations—particularly relevant for containerized workloads, cryptocurrency applications, and secure communication tools that leverage kernel crypto APIs.

Casky's extended reasoning capabilities would detect this vulnerability by correlating multiple suspicious patterns: detecting rapid successive sendmsg() calls to ALG_SET_IV followed by incomplete AIO recvmsg() operations, identifying socket-level race conditions through timing analysis of crypto context modifications, and flagging asynchronous cryptographic operations that lack proper serialization controls. While MITRE ATT&CK mapping isn't available for this CVE, practitioners would observe findings aligned with T1040 (Traffic Capture/Redirection) and T1555 (Credentials in Files) patterns—specifically the manipulation of cryptographic material in transit. Casky would highlight the specific vulnerability pattern: applications using AF_ALG sockets with async mode that fail to implement socket-level synchronization, allowing attackers to inject malicious cryptographic parameters between request submission and completion.