CVE-2026-80831

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. Therefore, sg_dma_len() is invalid and could return zero or a stale DMA length, causing encryption and decryption to process the wrong number of bytes when CONFIG_NEED_SG_DMA_LENGTH=y. Use the original scatterlist length instead.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/04201dcc88b26eac52f736e39727fc5c420b7257
https://git.kernel.org/stable/c/0e9edb108a63bbbef952dfcbc597e34ed9c1fb74
https://git.kernel.org/stable/c/1537bd55b4f842565068c54b47cd2ae1777d5f8f
https://git.kernel.org/stable/c/182f16a20d329a1c818d51dad57d9bf43d356c7c
https://git.kernel.org/stable/c/6ef9a4afb52cb102ab038cd42352c142d8505d09
https://git.kernel.org/stable/c/c5bcb084a9871e5b62afb5f48b60adfa13b5d9f8
https://git.kernel.org/stable/c/da14fae5203b72ca71ccfa9af8de9249e40d533a
https://git.kernel.org/stable/c/e72a795df521cb65b7c4705cc11078cdacfaa2f4
https://git.kernel.org/stable/c/fd0f211b27a6ec2ebd8c315683401b43adcc5511

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-04 16:18

Updated : 2026-09-04 16:18

NVD link : CVE-2026-80831

Mitre link : CVE-2026-80831

CVE.ORG link : CVE-2026-80831

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-80831", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5", "lessThan": "fd0f211b27a6ec2ebd8c315683401b43adcc5511", "versionType": "git"}, {"status": "affected", "version": "15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5", "lessThan": "04201dcc88b26eac52f736e39727fc5c420b7257", "versionType": "git"}, {"status": "affected", "version": "15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5", "lessThan": "e72a795df521cb65b7c4705cc11078cdacfaa2f4", "versionType": "git"}, {"status": "affected", "version": "15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5", "lessThan": "1537bd55b4f842565068c54b47cd2ae1777d5f8f", "versionType": "git"}, {"status": "affected", "version": "15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5", "lessThan": "da14fae5203b72ca71ccfa9af8de9249e40d533a", "versionType": "git"}, {"status": "affected", "version": "15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5", "lessThan": "182f16a20d329a1c818d51dad57d9bf43d356c7c", "versionType": "git"}, {"status": "affected", "version": "15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5", "lessThan": "0e9edb108a63bbbef952dfcbc597e34ed9c1fb74", "versionType": "git"}, {"status": "affected", "version": "15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5", "lessThan": "6ef9a4afb52cb102ab038cd42352c142d8505d09", "versionType": "git"}, {"status": "affected", "version": "15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5", "lessThan": "c5bcb084a9871e5b62afb5f48b60adfa13b5d9f8", "versionType": "git"}], "programFiles": ["drivers/crypto/mxs-dcp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"status": "unaffected", "version": "0", "lessThan": "3.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.269", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.220", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.187", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.156", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.108", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.49", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.13", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2.3", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/crypto/mxs-dcp.c"], "defaultStatus": "affected"}]}], "published": "2026-09-04T16:18:11.287", "references": [{"url": "https://git.kernel.org/stable/c/04201dcc88b26eac52f736e39727fc5c420b7257", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/0e9edb108a63bbbef952dfcbc597e34ed9c1fb74", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1537bd55b4f842565068c54b47cd2ae1777d5f8f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/182f16a20d329a1c818d51dad57d9bf43d356c7c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6ef9a4afb52cb102ab038cd42352c142d8505d09", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c5bcb084a9871e5b62afb5f48b60adfa13b5d9f8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/da14fae5203b72ca71ccfa9af8de9249e40d533a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e72a795df521cb65b7c4705cc11078cdacfaa2f4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fd0f211b27a6ec2ebd8c315683401b43adcc5511", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: mxs-dcp - fix source scatterlist length access\n\nmxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source\nscatterlist with dma_map_sg() first. Therefore, sg_dma_len() is invalid\nand could return zero or a stale DMA length, causing encryption and\ndecryption to process the wrong number of bytes when\nCONFIG_NEED_SG_DMA_LENGTH=y.\n\nUse the original scatterlist length instead."}], "lastModified": "2026-09-04T16:18:11.287", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}