Linux Kernel CVE-2026-53016: IO Buffer Overrun in ccp_aes_complete IA5
CVE-2026-53016 Published on June 24, 2026
crypto: ccp - copy IV using skcipher ivsize
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - copy IV using skcipher ivsize
AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.
ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV
buffer while RFC3686 skciphers expose an 8-byte IV, so the restore
overruns the provided buffer.
Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.
Vulnerability Analysis
CVE-2026-53016 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Buffer Access with Incorrect Length Value
The software uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer. When the length value exceeds the size of the destination, a buffer overflow could occur.
Products Associated with CVE-2026-53016
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-53016 are published in these products:
Affected Versions
Linux:- Version 2b789435d7f36ed918d92db647f3a2f3fec9bb1f and below 939061b2d0f7f15114e34b4ce878ef50ff4089c3 is affected.
- Version 2b789435d7f36ed918d92db647f3a2f3fec9bb1f and below 798d409a8949f3f495f238549b86de2886b129bd is affected.
- Version 2b789435d7f36ed918d92db647f3a2f3fec9bb1f and below dfb2cf434829819268fe50f41542aad318ad62b2 is affected.
- Version 2b789435d7f36ed918d92db647f3a2f3fec9bb1f and below eecee15e263ccb8cd77170a56ab6c969cb54dd6a is affected.
- Version 2b789435d7f36ed918d92db647f3a2f3fec9bb1f and below bb01d8f1f385bc9034ca114d3508c7fdea24fc9a is affected.
- Version 2b789435d7f36ed918d92db647f3a2f3fec9bb1f and below df9784bb5b637ac80f4a2768a58ca9a50bef28a9 is affected.
- Version 2b789435d7f36ed918d92db647f3a2f3fec9bb1f and below 227c1e1d9e2aa4cfc65ba446d5690da1f546cda4 is affected.
- Version 2b789435d7f36ed918d92db647f3a2f3fec9bb1f and below a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4 is affected.
- Version 3.14 is affected.
- Before 3.14 is unaffected.
- Version 5.10.258, <= 5.10.* is unaffected.
- Version 5.15.209, <= 5.15.* is unaffected.
- Version 6.1.175, <= 6.1.* is unaffected.
- Version 6.6.141, <= 6.6.* is unaffected.
- Version 6.12.91, <= 6.12.* is unaffected.
- Version 6.18.33, <= 6.18.* is unaffected.
- Version 7.0.10, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.
- Version 0:6.12.0-211.34.1.el10_2 and below * is unaffected.
- Version 0:4.18.0-553.156.1.rt7.497.el8_10 and below * is unaffected.
- Version 0:4.18.0-553.156.1.el8_10 and below * is unaffected.
- Version 0:4.18.0-372.208.1.el8_6 and below * is unaffected.
- Version 0:4.18.0-372.208.1.el8_6 and below * is unaffected.
- Version 0:5.14.0-687.25.1.el9_8 and below * is unaffected.
- Version 0:5.14.0-427.146.1.el9_4 and below * is unaffected.
- Version 0:5.14.0-570.135.1.el9_6 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.