CVE-2026-80831: crypto: mxs-dcp - fix source scatterlist length access
In the Linux kernel, the following vulnerability has been resolved:
crypto: mxs-dcp - fix source scatterlist length access
mxsdcpaesblockcrypt() uses sgdmalen() without mapping the source scatterlist with dmamapsg() first. Therefore, sgdmalen() is invalid and could return zero or a stale DMA length, causing encryption and decryption to process the wrong number of bytes when CONFIGNEEDSGDMALENGTH=y.
Use the original scatterlist length instead.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue affects Linux kernel systems using the mxs-dcp crypto driver when CONFIG_NEED_SG_DMA_LENGTH is enabled. The faulty path is in mxs_dcp_aes_block_crypt().
What is the practical impact?
Encryption or decryption can process an incorrect number of bytes because the driver reads an invalid, zero, or stale DMA scatterlist length. This can occur when the source scatterlist has not been mapped with dma_map_sg() before sg_dma_len() is used.
How was the issue fixed?
The fix changes the driver to use the original scatterlist length rather than sg_dma_len() for the unmapped source scatterlist.