Linux 7.3 Restricts AF_ALG to a Short Algorithm Allowlist by Default

Updated Oct. 26, 2026, 3:21 a.m. ET: Adds that Linux 7.3 shipped as a stable kernel on Oct. 18.

Linux 7.3 sharply limits AF_ALG, the socket interface that lets user-space programs call the kernel’s internal cryptography API. A new sysctl, /proc/sys/crypto/af_alg_restrict, defaults to a mode that allows only a short list of algorithms, Phoronix reported after the change was merged with the crypto updates for the release.

AF_ALG has been shrinking for several kernel cycles. Zero-copy support and offloading were dropped, and the interface was deprecated in Linux 7.2. Google’s Eric Biggers, who wrote the new restriction, explained the reasoning in his patch, quoted by Phoronix: “AF_ALG is a frequent source of vulnerabilities and a maintenance nightmare. It exposes far more functionality to userspace than ever should have been exposed, especially to unprivileged processes. Recent exploits have targeted kernel internal implementation details like “authencesn” that have zero use case for userspace access.”

He added that AF_ALG “is rarely used in practice, as userspace crypto libraries exist,” and that the known users, such as the iwd wireless daemon, need only a few algorithms.

Three Settings

The kernel documentation describes three values for af_alg_restrict:

• 0 leaves AF_ALG unrestricted, as in older kernels.
• 1, the default, enables an allowlist for unprivileged processes and a somewhat longer allowlist for processes holding CAP_SYS_ADMIN or CAP_NET_ADMIN in the initial user namespace. Binding a socket with a disallowed algorithm fails with ENOENT.
• 2 disables AF_ALG entirely, and creating a socket fails with EAFNOSUPPORT.

The default hash allowlist covers CMAC-AES, HMAC with MD5 and the SHA-1 and SHA-2 families, plus plain MD4, MD5, SHA-1 and SHA-2 hashes, which iwd still uses. A separate skcipher allowlist includes Adiantum, CBC, CTR and ECB modes of AES, DES and 3DES variants, and HCTR2, covering algorithms used by iwd, BlueZ and cryptsetup. Biggers said he tested that iwd still works with the default and noted that the list may change.

What Administrators Should Check

Most systems will not notice the change, since mainstream crypto libraries do their work in user space. The risk falls on software that quietly offloads to the kernel through AF_ALG, including some embedded and hardware-acceleration setups. Teams moving to Linux 7.3 should test those workloads and look for ENOENT errors on bind() calls. Setting af_alg_restrict to 0 restores the old behavior, while security-focused deployments with no AF_ALG users can set it to 2 and remove the attack surface completely.

With AF_ALG already deprecated, Phoronix’s Michael Larabel has suggested the next steps could be disabling the interface by default and eventually removing it, so applications that still depend on it should plan a move to user-space crypto.