CVE-2026-98805: Linux Vulnerability

Description

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix (a per-key salt XOR the peer's address) followed by a 64-bit counter. That counter is stored in the peer's RX crypto object. When the peer reports a change in which key it uses to receive packets, TIPC resets this counter. The sender can still be using the same TX key and salt, so subsequent packets reuse earlier nonces. This nonce reuse breaks confidentiality and exposes GCM's authentication key. This makes forgeries trivial: an attacker can exploit CTR malleability to alter captured ciphertexts and use the recovered authentication key to compute a valid tag for the modified ciphertext, under the same key and nonce. Use the TX key's existing aead->seqno counter instead. All encryptions using that key object share the same atomic counter, so concurrent encryptions get distinct nonce counter values. The counter survives key activation and peer reconnection, and peer key-status reports cannot reset it. This prevents those transitions from causing nonce reuse while the same TX key remains installed. The nonce format is unchanged, and receivers do not require consecutive counter values, so sharing the counter across peers remains compatible with existing receivers. A pre-existing check still invokes key revocation in the unlikely event that the counter wraps to zero.

Metrics

EPSS Probability

0.13%

2.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0, < 04d67f77fe3f9ec9c60db70773fb1696d0d58da8; >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0, < 7e5d5ac25e0857548cac963a2f850b19b2e1d59c; >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0, < 0ff0ca5b514ceecad68b8682e072f373acc5acec; >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0, < a85a3dce4b6c73ddaa1e9725b906249744bf7cf2; >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0, < 5c8ce13c792e28d56f9ec3cd6728d8225bc0e3a2; >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0, < f74f100e49588c1dbdc6ab3ba9e2c67b36d015d0; >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0, < 60e0c2aeaa605ff19ca4e65126a35643d4d7ee1c; >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0, < 512ccd3d0e91e791fb37442aa0a2599aca19783d
Linux	Linux	5.5

References

Timeline

Published: Oct 18, 2026
Last Modified: Oct 30, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-98805?

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix (a per-key salt XOR the peer's address) followed by a 64-bit counter. That counter is stored in the peer's RX crypto object. When the peer reports a change in which key it uses to receive packets, TIPC resets this counter. The sender can still be using the same TX key and salt, so subsequent packets reuse earlier nonces. This nonce reuse breaks confidentiality and exposes GCM's authentication key. This makes forgeries trivial: an attacker can exploit CTR malleability to alter captured ciphertexts and use the recovered authentication key to compute a valid tag for the modified ciphertext, under the same key and nonce. Use the TX key's existing aead->seqno counter instead. All encryptions using that key object share the same atomic counter, so concurrent encryptions get distinct nonce counter values. The counter survives key activation and peer reconnection, and peer key-status reports cannot reset it. This prevents those transitions from causing nonce reuse while the same TX key remains installed. The nonce format is unchanged, and receivers do not require consecutive counter values, so sharing the counter across peers remains compatible with existing receivers. A pre-existing check still invokes key revocation in the unlikely event that the counter wraps to zero.

How severe is CVE-2026-98805?

Severity scoring for CVE-2026-98805 is pending analysis. The EPSS model estimates a 0.13% probability of exploitation in the next 30 days.

How do I fix CVE-2026-98805?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →