CVE-2026-80945: crypto: iaa - unmap dst before software fallback on decompress
In the Linux kernel, the following vulnerability has been resolved:
crypto: iaa - unmap dst before software fallback on decompress
On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMAFROMDEVICE. With SWIOTLB active the later dmaunmapsg() copies the stale bounce buffer over req->dst, corrupting the result.
Unmap before the fallback runs. The async path unmaps inline; the sync path signals the retry with -EAGAIN so iaacompadecompress() runs the fallback after unmapping.
Event History
Frequently Asked Questions
What conditions are required for the corruption to occur?
The IAA decompression operation must encounter a hardware analytics error and retry through the software fallback. SWIOTLB must be active, because the stale DMA bounce buffer is copied over the software-written destination during the later DMA unmap.
What is the practical impact of an affected system?
The decompression result can be corrupted when the fallback writes to req->dst while that buffer remains mapped DMA_FROM_DEVICE. The issue is a result-integrity problem caused by the later dma_unmap_sg() overwriting the destination with stale bounce-buffer data.
How does the fix prevent the issue?
It unmaps the destination buffer before the software fallback runs. The asynchronous path unmaps inline, while the synchronous path returns -EAGAIN so iaa_comp_adecompress() performs the fallback after unmapping.