CVE-2026-74578 patches a critical flaw in the AF_ALG async interface for skcipher operations. The vulnerability: when using CBC or CTR mode ciphers through the async path (io_submit), the socket lock is dropped after submission but before completion, creating a window where the initialization vector (IV) can be corrupted by concurrent operations. The IV chaining that these modes depend on gets clobbered, producing silently corrupted ciphertext or plaintext that applications consume believing it is valid.
The upstream fix removes the async branch entirely in crypto/algif_skcipher.c, making all operations synchronous. This is the correct remediation, but understand why: the AF_ALG async interface was designed around the assumption that cryptographic operations are stateless — IV state must be written back in-place to the request structure, but the completion callback runs in atomic context where writeback is impossible. For statesize==0 ciphers like CBC and CTR, there's no persistent state object to snapshot; the IV chaining relies on req->iv writeback that simply cannot happen safely in the async completion path.
For defenders: verify whether any code in your environment uses AF_ALG with the async path for CBC, CTR, or other stateful modes. The EPSS score of 0.00146 indicates low current exploitation, but this reflects the obscurity of the interface, not the severity of the failure. The silent-corruption path — where applications consume wrong output believing it valid — is more damaging than any exploit requiring a concurrent attacker. Audit logs showing successful crypto operations provide no assurance here; the corruption is invisible at the API boundary.
If you maintain software that depends on non-blocking AF_ALG skcipher operations, you must either migrate to synchronous calls or use a different async crypto interface that properly handles stateful IV chaining. The kernel removed this capability because the design was unsalvageable, not because a better fix was too expensive. This pattern — async I/O extended to stateful operations without accounting for in-place state writeback — likely exists in other kernel subsystems. Treat any async crypto path that handles CBC, CTR, or authenticated modes with extreme skepticism until the locking model is explicitly documented as safe.