Commit 7bedb45134 for strongswan.org

commit 7bedb451346261370256d390a8c155b86e4b455d
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Thu Jun 4 10:00:02 2026 +0200

    eap-aka: Only accept AKA-Synchronization-Failure if expected

    This fixes a NULL-pointer dereference if the client sends such an error
    before the server issued a challenge and allocated this->rand.

    Fixes: 26e246769224 ("ported EAP-AKA branch into trunk")
    Fixes: 4735965fc048 ("EAP servers check if the received EAP message was expected")
    Fixes: CVE-2026-78126

diff --git a/src/libcharon/plugins/eap_aka/eap_aka_server.c b/src/libcharon/plugins/eap_aka/eap_aka_server.c
index 89e51c733b..1140fea579 100644
--- a/src/libcharon/plugins/eap_aka/eap_aka_server.c
+++ b/src/libcharon/plugins/eap_aka/eap_aka_server.c
@@ -505,6 +505,12 @@ static status_t process_synchronize(private_eap_aka_server_t *this,
 	simaka_attribute_t type;
 	chunk_t data, auts = chunk_empty;

+	if (this->pending != AKA_CHALLENGE)
+	{
+		DBG1(DBG_IKE, "received %N, but not expected",
+			 simaka_subtype_names, AKA_SYNCHRONIZATION_FAILURE);
+		return FAILED;
+	}
 	if (this->synchronized)
 	{
 		DBG1(DBG_IKE, "received %N, but peer did already resynchronize",