CVE-2026-80945: crypto: iaa - unmap dst before software fallback on decompress
In the Linux kernel, the following vulnerability has been resolved:
crypto: iaa - unmap dst before software fallback on decompress
On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMAFROMDEVICE. With SWIOTLB active the later dmaunmapsg() copies the stale bounce buffer over req->dst, corrupting the result.
Unmap before the fallback runs. The async path unmaps inline; the sync path signals the retry with -EAGAIN so iaacompadecompress() runs the fallback after unmapping.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required for the corruption to occur?
The IAA decompression operation must encounter a hardware analytics error and retry through the software fallback. SWIOTLB must be active, because the stale DMA bounce buffer is copied over the software-written destination during the later DMA unmap.
What is the practical impact of an affected system?
The decompression result can be corrupted when the fallback writes to req->dst while that buffer remains mapped DMA_FROM_DEVICE. The issue is a result-integrity problem caused by the later dma_unmap_sg() overwriting the destination with stale bounce-buffer data.
How does the fix prevent the issue?
It unmaps the destination buffer before the software fallback runs. The asynchronous path unmaps inline, while the synchronous path returns -EAGAIN so iaa_comp_adecompress() performs the fallback after unmapping.