--- title: New AF_ALG Restrictions With Linux 7.3 Due To The... description: Linux 7.3 introduces a new af_alg_restrict sysctl that limits AF_ALG cryptography interface access by default, following its deprecation in Linux 7.2. By... canonical: https://daily.dev/posts/new-af-alg-restrictions-with-linux-7-3-due-to-the-security-maintenance-nightmare-t1qbhz3lj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare | daily.dev og:description: Linux 7.3 introduces a new af_alg_restrict sysctl that limits AF_ALG cryptography interface access by default, following its deprecation in Linux 7.2. By... og:url: https://daily.dev/posts/new-af-alg-restrictions-with-linux-7-3-due-to-the-security-maintenance-nightmare-t1qbhz3lj og:image: https://api.daily.dev/og/posts/t1qBHZ3LJ.png og:image:alt: New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare **[Phoronix](https://daily.dev/sources/phoronix)** · 2 min read · 0 upvotes · 0 comments ## Summary Linux 7.3 introduces a new af_alg_restrict sysctl that limits AF_ALG cryptography interface access by default, following its deprecation in Linux 7.2. By default (af_alg_restrict=1), only a specific allow-list of hash and cipher algorithms needed by IWD, BlueZ, and cryptsetup remain accessible; the sysctl can also be set to allow unrestricted access or block AF_ALG entirely. The change stems from ongoing security vulnerabilities and maintenance burden tied to AF_ALG. The same crypto pull also marks the Qualcomm QCE driver as broken, removes crypto_rng from several drivers, and fixes a suspend/resume race in the hardware RNG code. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the af_alg_restrict sysctl do in Linux 7.3? It restricts the AF_ALG userspace cryptography interface to a limited allow-list of algorithms by default. Set to af_alg_restrict=1, it permits only hashes like HMAC SHA1/SHA256/SHA512, MD5, SHA1-512, and ciphers like CBC AES, CTR AES, and Adiantum, since these are the ones IWD, BlueZ, and cryptsetup actually depend on. It can also be set to allow unrestricted access or to block AF_ALG entirely. _Track kernel security tunables like af_alg_restrict on daily.dev before they affect your crypto stack._ ### Why is AF_ALG being restricted in the Linux kernel? AF_ALG is being restricted because it has become a security vulnerability risk and a maintenance burden for kernel developers. Linux already deprecated AF_ALG in version 7.2 and had previously removed zero-copy support and offloading; version 7.3 adds the af_alg_restrict sysctl to limit exposure to only the algorithms still needed by userspace daemons like IWD. _Developers relying on kernel crypto interfaces can follow changes like this on daily.dev to avoid breakage._ ### Which programs still depend on the Linux AF_ALG interface? IWD (the wireless daemon), BlueZ, and cryptsetup are the known userspace programs still dependent on AF_ALG. The Linux 7.3 allow-list of hash and cipher algorithms was specifically curated to preserve functionality for these three tools while blocking everything else by default via af_alg_restrict. _Anyone maintaining userspace tools tied to kernel crypto APIs can watch for changes like this via daily.dev._ ## Similar posts on daily.dev - [AF\_ALG "Nightmare" Being Further Limited In Linux 7.3 With New Sysctl Knob](https://daily.dev/posts/af-alg-nightmare-being-further-limited-in-linux-7-3-with-new-sysctl-knob-uie7youff) · Phoronix · 0 upvotes · 0 comments - [AF\_ALG Deprecation Approved For Linux 7.2, Useless & Insecure Crypto Driver Code Removed](https://daily.dev/posts/af-alg-deprecation-approved-for-linux-7-2-useless-insecure-crypto-driver-code-removed-d0o4cojrm) · Phoronix · 0 upvotes · 0 comments - [Linux 7.2 Proceeding To Deprecate AF\_ALG Due To "Massive Attack Surface", Drops Offloading](https://daily.dev/posts/linux-7-2-proceeding-to-deprecate-af-alg-due-to-massive-attack-surface-drops-offloading-nf430kqlr) · Phoronix · 0 upvotes · 0 comments - [Linux AF\_ALG Crypto Code Removing Zero-Copy Support Out Of Security Concerns](https://daily.dev/posts/linux-af-alg-crypto-code-removing-zero-copy-support-out-of-security-concerns-9ewpyfj1c) · Phoronix · 0 upvotes · 0 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#linux](https://daily.dev/tags/linux), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/new-af-alg-restrictions-with-linux-7-3-due-to-the-security-maintenance-nightmare-t1qbhz3lj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare","url":"https://daily.dev/posts/new-af-alg-restrictions-with-linux-7-3-due-to-the-security-maintenance-nightmare-t1qbhz3lj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-af-alg-restrictions-with-linux-7-3-due-to-the-security-maintenance-nightmare-t1qbhz3lj"},"datePublished":"2026-08-24T18:22:13.167Z","dateModified":"2026-08-25T09:55:27.991Z","description":"Linux 7.3 introduces a new af_alg_restrict sysctl that limits AF_ALG cryptography interface access by default, following its deprecation in Linux 7.2. By...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7596d861b934d5f815a196c34566c97c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7596d861b934d5f815a196c34566c97c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Phoronix","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Phoronix","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/6a26ba379dd64932830aa0c9803dd7ee","url":"https://daily.dev/sources/phoronix"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-af-alg-restrictions-with-linux-7-3-due-to-the-security-maintenance-nightmare-t1qbhz3lj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source,linux,cryptography","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Phoronix","item":"https://daily.dev/sources/phoronix"},{"@type":"ListItem","position":3,"name":"New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-af-alg-restrictions-with-linux-7-3-due-to-the-security-maintenance-nightmare-t1qbhz3lj#faq","mainEntity":[{"@type":"Question","name":"What does the af_alg_restrict sysctl do in Linux 7.3?","acceptedAnswer":{"@type":"Answer","text":"It restricts the AF_ALG userspace cryptography interface to a limited allow-list of algorithms by default. Set to af_alg_restrict=1, it permits only hashes like HMAC SHA1/SHA256/SHA512, MD5, SHA1-512, and ciphers like CBC AES, CTR AES, and Adiantum, since these are the ones IWD, BlueZ, and cryptsetup actually depend on. It can also be set to allow unrestricted access or to block AF_ALG entirely. Track kernel security tunables like af_alg_restrict on daily.dev before they affect your crypto stack."}},{"@type":"Question","name":"Why is AF_ALG being restricted in the Linux kernel?","acceptedAnswer":{"@type":"Answer","text":"AF_ALG is being restricted because it has become a security vulnerability risk and a maintenance burden for kernel developers. Linux already deprecated AF_ALG in version 7.2 and had previously removed zero-copy support and offloading; version 7.3 adds the af_alg_restrict sysctl to limit exposure to only the algorithms still needed by userspace daemons like IWD. Developers relying on kernel crypto interfaces can follow changes like this on daily.dev to avoid breakage."}},{"@type":"Question","name":"Which programs still depend on the Linux AF_ALG interface?","acceptedAnswer":{"@type":"Answer","text":"IWD (the wireless daemon), BlueZ, and cryptsetup are the known userspace programs still dependent on AF_ALG. The Linux 7.3 allow-list of hash and cipher algorithms was specifically curated to preserve functionality for these three tools while blocking everything else by default via af_alg_restrict. Anyone maintaining userspace tools tied to kernel crypto APIs can watch for changes like this via daily.dev."}}]} ```