CVE-2026-80945

crypto: iaa - unmap dst before software fallback on decompress

Published Sep 11, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - unmap dst before software fallback on decompress

On a hardware analytics error, decompress retries through the software
fallback, which writes req->dst with the CPU while it is still mapped
DMA_FROM_DEVICE. With SWIOTLB active the later dma_unmap_sg() copies the
stale bounce buffer over req->dst, corrupting the result.

Unmap before the fallback runs. The async path unmaps inline; the sync
path signals the retry with -EAGAIN so iaa_comp_adecompress() runs the
fallback after unmapping.

Analysis

Technical impact

An out‑of‑bounds write occurs in the Linux kernel crypto IAAs decompression routine when a hardware error forces a fallback to software decompression. While SWIOTLB is active, the destination buffer remains mapped for DMA_FROM_DEVICE and the software path writes over stale data, corrupting the output. This flaw is a classic memory corruption bug (CWE‑787) that can lead to data integrity problems and potentially disrupt cryptographic operations.

Affected Systems

All Linux kernel builds that include the crypto IAAs decompression feature and have not applied the upstream change are affected. The issue is present across all vendor distributions that ship the kernel without the patch; no specific version numbers are listed in the CNA data.

Risk and Exploitability

The CVSS score of 9.1 signals a high‑severity flaw, while the EPSS score of less than 1 % reflects a very low but non‑zero likelihood of exploitation. The vulnerability is not flagged in CISA’s KEV catalog. Real‑world exploitation would require an attacker to induce a hardware error that triggers the decompress retry with SWIOTLB enabled—an action that is non‑trivial and typically demands privileged or specialized hardware. Consequently, while the potential impact is severe, the probability of exploitation in the wild remains low.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2ec6761df889fdf896fde761abd447596dd8f8c2`	affected	< c0279e5ea2aad99d8b91f1a6579d751cc9eb2408
`2ec6761df889fdf896fde761abd447596dd8f8c2`	affected	< fc933a4a419ba8a75da28666a018602c44846953
`2ec6761df889fdf896fde761abd447596dd8f8c2`	affected	< fcd86180ef78b0e41763faef7c6d2de7dfb50c1a
`2ec6761df889fdf896fde761abd447596dd8f8c2`	affected	< 94a25930477113730372e0fa2985da4c5ac95c9a

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.12.111`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[2ec6761df889fdf896fde761abd447596dd8f8c2,fc933a4a419ba8a75da28666a018602c44846953)`	affected	code_commit	—
`[2ec6761df889fdf896fde761abd447596dd8f8c2,fcd86180ef78b0e41763faef7c6d2de7dfb50c1a)`	affected	code_commit	—
`[2ec6761df889fdf896fde761abd447596dd8f8c2,94a25930477113730372e0fa2985da4c5ac95c9a)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that contains the IAAs decompression fix for the Linux kernel crypto module.
If an update is not yet available, temporarily disable SWIOTLB in the kernel configuration or via relevant sysctl settings to prevent the stale DMA condition while waiting for the patch.
Consider switching to a hardware cryptographic accelerator that bypasses the IAAs decompression path, or restart affected services to reload the crypto module without engaging the decompression logic.

Generated by OpenCVE AI on September 21, 2026 at 02:54 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.501% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/94a25930477113730372e0fa2985da4c5ac95c9a
https://git.kernel.org/stable/c/c0279e5ea2aad99d8b91f1a6579d751cc9eb2408
https://git.kernel.org/stable/c/fc933a4a419ba8a75da28666a018602c44846953
https://git.kernel.org/stable/c/fcd86180ef78b0e41763faef7c6d2de7dfb50c1a
https://nvd.nist.gov/vuln/detail/CVE-2026-80945
https://www.cve.org/CVERecord?id=CVE-2026-80945

History

Sep 21, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/c0279e5ea2aad99d8b91f1a6579d751cc9eb2408

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}`	cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80945 https://www.cve.org/CVERecord?id=CVE-2026-80945
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMA_FROM_DEVICE. With SWIOTLB active the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result. Unmap before the fallback runs. The async path unmaps inline; the sync path signals the retry with -EAGAIN so iaa_comp_adecompress() runs the fallback after unmapping.
Title		crypto: iaa - unmap dst before software fallback on decompress
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/94a25930477113730372e0fa2985da4c5ac95c9a https://git.kernel.org/stable/c/fc933a4a419ba8a75da28666a018602c44846953 https://git.kernel.org/stable/c/fcd86180ef78b0e41763faef7c6d2de7dfb50c1a