Linux kernel crypto/algif_skcipher async skcipher_recvmsg() passes ctx->iv into in-flight requests; after io_submit() unlock, concurrent sendmsg(ALG_SET_IV) can overwrite the IV. In CTR/stream modes this enables IV/keystream reuse and plaintext recovery by unprivileged users. Fix: remove AIO branch/force sync. Debian: bullseye fixed 5.10.262-1, bookworm 6.1.180-1, trixie 6.12.101-1.