---
id: "CVE-2026-98805"
kind: "vulnerability"
aliases: ["CVE-2026-98805"]
title: "Linux kernel TIPC: peer key change lets AES-GCM nonces repeat"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cluster-nodes", "linux-kernel", "runtime", "tipc"]
not_affected_if: ["no-tipc-usage"]
published_at: "2026-10-18T16:17:34+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:15:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98805", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel TIPC: peer key change lets AES-GCM nonces repeat

When a TIPC peer reports a key change, the kernel resets the counter used in AES-GCM nonces, so the same key and nonce can be reused on later packets. Reused GCM nonces can let an attacker recover the authentication key and forge valid tags for modified traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98805

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tipc: prevent GCM nonce reuse on peer key changes

TIPC can encrypt traffic between nodes using a different transmit key
for each node. In this mode, the AES-GCM nonce for a packet sent to a
known peer consists of a 32-bit prefix (a per-key salt XOR the peer's
address) followed by a 64-bit counter. That counter is stored in the
peer's RX crypto object. When the peer reports a change in which key
it uses to receive packets, TIPC resets this counter. The sender can
still be using the same TX key and salt, so subsequent packets reuse
earlier nonces. This nonce reuse breaks confidentiality and exposes
GCM's authentication key. This makes forgeries trivial: an attacker
can exploit CTR malleability to alter captured ciphertexts and use the
recovered authentication key to compute a valid tag for the modified
ciphertext, under the same key and nonce.

Use the TX key's existing aead->seqno counter instead. All encryptions
using that key object share the same atomic counter, so concurrent
encryptions get distinct nonce counter values. The counter survives
key activation and peer reconnection, and peer key-status reports
cannot reset it. This prevents those transitions from causing nonce
reuse while the same TX key remains installed.

The nonce format is unchanged, and receivers do not require consecutive
counter values, so sharing the counter across peers remains compatible
with existing receivers. A pre-existing check still invokes key
revocation in the unlikely event that the counter wraps to zero.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_