Bug 2550256 (CVE-2026-77206)

Summary:	CVE-2026-77206 libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, echaudro, fleitner, jdelft, jupierce, ktraynor, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, rkhan, sfaye, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2550632
Bug Blocks:

Description OSIDB Bzimport 2026-10-13 07:58:07 UTC

The Libreswan Project was informed of a Null Pointer Dereference bug in the EAP handling code for authentication that can result in a denial of service against the libreswan pluto daemon. 

As a result of inconsistency within the IKEv2 state machine code, a bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The bug results in a crash and restart. No remote code execution is possible. The error is caused by a fall-through error where it incorrectly dereferences ike->sa.st_eap which is NULL.

An malicious IKE_AUTH packet can trigger this bug, meaning the peer need not be authenticated. Continued attempts to use IKEv2 with such malicious payloads can cause a denial of service. No remote code execution is possible.

Vulnerable versions : 4.7 - 5.4
Not vulnerable      : 5.3.3, 5.4.1