A buffer‑length error in the Linux kernel’s MX.3 DCP crypto driver causes the sg_dma_len() call to be used without correctly mapping the source scatterlist. As a result the function may return zero or a stale DMA length, leading to encryption or decryption of an incorrect number of bytes. This flaw does not give an attacker code execution but can corrupt the data supplied to or produced by the crypto operation, undermining integrity and potentially confidentiality of the processed data. The weakness is rooted in improper initialization and use of a kernel API (CWE‑665). The impact is limited to cryptographic correctness rather than direct privilege escalation.

All Linux kernel configurations that enable the MX.3 DCP crypto driver with CONFIG_NEED_SG_DMA_LENGTH active are affected. The flaw exists in the kernel source for all versions up to the latest patch that included the fix, regardless of vendor distribution; any distribution that has not applied the kernel commit identified by the referenced Git references is potentially vulnerable.

Because the bug only alters the length passed to the cryptographic routine, remote exploitation is not evident. The vulnerability is a moderate‑severity flaw: it is unlikely to be exploited without privileged or local access, and it does not appear in the CISA KEV catalog. Attackers who can arrange for victim processes to use the affected crypto path may induce data corruption, but not arbitrary code execution. The absence of an EPSS score or CVSS rating limits quantitative risk assessment, yet the defect does pose a non‑negligible risk to data integrity in affected systems.