CVE-2026-80832: crypto: qce - fix CCM AAD buffer underallocation
In the Linux kernel, the following vulnerability has been resolved:
crypto: qce - fix CCM AAD buffer underallocation
The AAD buffer allocated in qceaeadccmpreparebufassoclen() can be smaller than the length later programmed into the DMA scatterlist.
The allocation size is currently calculated as:
ALIGN(assoclen, 16) + MAXCCMADATAHEADERLEN
while the DMA length is set to:
ALIGN(assoclen + adataheaderlen, 16)
Since ALIGN() does not distribute over addition, the allocation can be smaller than the DMA length. For example, when assoclen = 32 and adataheaderlen = 2:
allocation = ALIGN(32, 16) + 6 = 38 DMA length = ALIGN(32 + 2, 16) = 48
As a result, the QCE hardware can read beyond the allocated buffer while computing the CBC-MAC over the associated data. The extra bytes are folded into the authentication tag, resulting in an incorrect tag and causing CCM self-test failures such as:
alg: aead: ccm-aes-qce encryption test failed (wrong result) on test vector 8
Fix the allocation by adding the maximum possible AAD header length before alignment:
ALIGN(assoclen + MAXCCMADATAHEADERLEN, 16)
This guarantees that the allocated buffer is large enough for the fully padded AAD data for all supported header sizes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix qce CCM AAD buffer underallocation by increasing the allocated buffer size to include the maximum possible AAD header length when calculating allocation in qce_aead_ccm_prepare_buf_assoclen(), so the allocation is large enough for QCE hardware DMA reads while computing CBC-MAC.
Linux kernel crypto (qce) CCM AAD buffer allocation sizing in qce_aead_ccm_prepare_buf_assoclen() = allocation = ALIGN(32, 16) + MAX_CCM_ADATA_HEADER_LEN (add maximum possible AAD header) - Operational
After applying the allocation fix, re-run the CCM self-test because the failure mode described is 'alg: aead: ccm-aes-qce encryption test failed (wrong result)' / incorrect tags due to AAD buffer underallocation.
Event History
Frequently Asked Questions
Which cryptographic operations are affected?
The issue affects CCM operations handled by the QCE crypto driver when associated authenticated data (AAD) is prepared. The hardware can be programmed to process more padded AAD bytes than were allocated.
What condition triggers the incorrect buffer sizing?
It occurs when separately aligning the AAD length and then adding the header reservation produces a smaller value than aligning the combined AAD and header lengths. For example, an AAD length of 32 bytes with a 2-byte header leads to a 38-byte allocation but a 48-byte DMA length.
How can an affected system be identified?
CCM QCE self-tests can fail because the hardware incorporates bytes beyond the allocated buffer into the CBC-MAC calculation. An example symptom is an “alg: aead: ccm-aes-qce encryption test failed (wrong result)” failure on test vector 8.
What does the fix change?
The fix allocates the AAD buffer by adding the maximum possible AAD header length before applying 16-byte alignment. This ensures the allocation covers the fully padded AAD length used by the DMA scatterlist.