{
  "cveId": "CVE-2026-98805",
  "url": "https://patchblox.com/security/cve/CVE-2026-98805",
  "summary": "CVE-2026-98805 is fixed in 39 products on 1 platform, first by DEBIAN-CVE-2026-98805, released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "tipc: prevent GCM nonce reuse on peer key changes",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  tipc: prevent GCM nonce reuse on peer key changes  TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix (a per-key salt XOR the peer\u0027s address) followed by a 64-bit counter. That counter is stored in the peer\u0027s RX crypto object. When the peer reports a change in which key it uses to receive packets, TIPC resets this counter. The sender can still be using the same TX key and salt, so subsequent packets reuse earlier nonces. This nonce reuse breaks confidentiality and exposes GCM\u0027s authentication key. This makes forgeries trivial: an attacker can exploit CTR malleability to alter captured ciphertexts and use the recovered authentication key to compute a valid tag for the modified ciphertext, under the same key and nonce.  Use the TX key\u0027s existing aead-\u003Eseqno counter instead. All encryptions using that key object share the same atomic counter, so concurrent encryptions get distinct nonce counter values. The counter survives key activation and peer reconnection, and peer key-status reports cannot reset it. This prevents those transitions from causing nonce reuse while the same TX key remains installed.  The nonce format is unchanged, and receivers do not require consecutive counter values, so sharing the counter across peers remains compatible with existing receivers. A pre-existing check still invokes key revocation in the unlikely event that the counter wraps to zero.",
  "published": "2026-10-18T16:17:34Z",
  "severity": "Moderate",
  "cvss": 6.8,
  "epss": 0.00179,
  "epssPercentile": 0.07469,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98805",
  "fixes": [
    {
      "platform": "linux",
      "product": "bpftool6.12",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "bpftool6.12-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "bpftool6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "bpftool6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-6.12.113-138.209",
      "release": "amzn 2023",
      "fixedVersion": "1:1.0-0.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-6.18.56-125.164",
      "release": "amzn 2023",
      "fixedVersion": "1:1.0-0.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-debuginfo-common-aarch64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-debuginfo-common-x86_64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-headers",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-modules-extra",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-modules-extra-common",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-tools",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-tools-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-tools-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-debuginfo-common-aarch64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-debuginfo-common-x86_64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-headers",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-modules-extra",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-modules-extra-common",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-tools",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-tools-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-tools-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-98805",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98805",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98805",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98805",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.113-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-98805",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98805",
      "released": "2026-10-19T16:27:52Z"
    },
    {
      "platform": "linux",
      "product": "microvm-kernel6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "perf6.12",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "perf6.12-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "perf6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "perf6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.12",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.12-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.113-138.209.amzn2023",
      "fix": "ALAS2023-2026-3335",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.56-125.164.amzn2023",
      "fix": "ALAS2023-2026-3251",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251",
      "released": "2026-11-07T01:06:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}