CVE-2026-80522: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
In the Linux kernel, the following vulnerability has been resolved:
crypto: tegra - fix rctx->cryptlen calculation in tegragcmdoonereq()
Perform rctx->cryptlen calculation in tegragcmdoonereq() the same way it is done in tegraccmcryptinit(). The current formulae may lead to a crash if a caller does not call tegragcmsetauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dstsg buffer.
As a follow-up cleanup delete struct tegraaeadctx->authsize field since it appears to be completely unused. Also simplify tegraccmsetauthsize() and tegragcmsetauthsize() functions respectively.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required to trigger the crash or out-of-bounds write?
The affected path requires a Tegra GCM decrypt operation where the caller has not called tegra_gcm_setauthsize(), leaving ctx->authsize at zero. Under those conditions, an incorrect rctx->cryptlen calculation can cause a write beyond the rctx->dst_sg buffer.
Are systems using the Linux kernel generally affected by this issue?
The issue is in the Linux kernel's Tegra crypto GCM request handling. The provided information does not establish that unrelated kernel crypto implementations or non-Tegra paths are affected.
What is the remediation described by the fix?
The fix calculates rctx->cryptlen in tegra_gcm_do_one_req() using the same approach as tegra_ccm_crypt_init(). It also removes the apparently unused tegra_aead_ctx->authsize field and simplifies the CCM and GCM authentication-size setter functions.