CVE-2026-80945 - Vulnerability Details

- crypto: iaa - unmap dst before software fallback on decompress

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - unmap dst before software fallback on decompress

On a hardware analytics error, decompress retries through the software
fallback, which writes req->dst with the CPU while it is still mapped
DMA_FROM_DEVICE. With SWIOTLB active the later dma_unmap_sg() copies the
stale bounce buffer over req->dst, corrupting the result.

Unmap before the fallback runs. The async path unmaps inline; the sync
path signals the retry with -EAGAIN so iaa_comp_adecompress() runs the
fallback after unmapping.

Published: 2026-09-11

Score: 9.1 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An out‑of‑bounds write occurs in the Linux kernel crypto IAAs decompression routine when a hardware error forces a fallback to software decompression. While SWIOTLB is active, the destination buffer remains mapped for DMA_FROM_DEVICE and the software path writes over stale data, corrupting the output. This flaw is a classic memory corruption bug (CWE‑787) that can lead to data integrity problems and potentially disrupt cryptographic operations.

Affected Systems

All Linux kernel builds that include the crypto IAAs decompression feature and have not applied the upstream change are affected. The issue is present across all vendor distributions that ship the kernel without the patch; no specific version numbers are listed in the CNA data.

Risk and Exploitability

The CVSS score of 9.1 signals a high‑severity flaw, while the EPSS score of less than 1 % reflects a very low but non‑zero likelihood of exploitation. The vulnerability is not flagged in CISA’s KEV catalog. Real‑world exploitation would require an attacker to induce a hardware error that triggers the decompress retry with SWIOTLB enabled—an action that is non‑trivial and typically demands privileged or specialized hardware. Consequently, while the potential impact is severe, the probability of exploitation in the wild remains low.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2ec6761df889fdf896fde761abd447596dd8f8c2`	affected	< c0279e5ea2aad99d8b91f1a6579d751cc9eb2408
`2ec6761df889fdf896fde761abd447596dd8f8c2`	affected	< fc933a4a419ba8a75da28666a018602c44846953
`2ec6761df889fdf896fde761abd447596dd8f8c2`	affected	< fcd86180ef78b0e41763faef7c6d2de7dfb50c1a
`2ec6761df889fdf896fde761abd447596dd8f8c2`	affected	< 94a25930477113730372e0fa2985da4c5ac95c9a

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.12.111`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2ec6761df889fdf896fde761abd447596dd8f8c2,fc933a4a419ba8a75da28666a018602c44846953)`	affected	code_commit	—
`[2ec6761df889fdf896fde761abd447596dd8f8c2,fcd86180ef78b0e41763faef7c6d2de7dfb50c1a)`	affected	code_commit	—
`[2ec6761df889fdf896fde761abd447596dd8f8c2,94a25930477113730372e0fa2985da4c5ac95c9a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that contains the IAAs decompression fix for the Linux kernel crypto module.
If an update is not yet available, temporarily disable SWIOTLB in the kernel configuration or via relevant sysctl settings to prevent the stale DMA condition while waiting for the patch.
Consider switching to a hardware cryptographic accelerator that bypasses the IAAs decompression path, or restart affected services to reload the crypto module without engaging the decompression logic.

Generated by OpenCVE AI on September 21, 2026 at 02:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00522.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/94a25930477113730372e0fa2985da4c5ac95c9a
https://git.kernel.org/stable/c/c0279e5ea2aad99d8b91f1a6579d751cc9eb2408
https://git.kernel.org/stable/c/fc933a4a419ba8a75da28666a018602c44846953
https://git.kernel.org/stable/c/fcd86180ef78b0e41763faef7c6d2de7dfb50c1a
https://nvd.nist.gov/vuln/detail/CVE-2026-80945
https://www.cve.org/CVERecord?id=CVE-2026-80945

History

Mon, 21 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/c0279e5ea2aad99d8b91f1a6579d751cc9eb2408

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}`	cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80945 https://www.cve.org/CVERecord?id=CVE-2026-80945
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMA_FROM_DEVICE. With SWIOTLB active the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result. Unmap before the fallback runs. The async path unmaps inline; the sync path signals the retry with -EAGAIN so iaa_comp_adecompress() runs the fallback after unmapping.
Title		crypto: iaa - unmap dst before software fallback on decompress
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/94a25930477113730372e0fa2985da4c5ac95c9a https://git.kernel.org/stable/c/fc933a4a419ba8a75da28666a018602c44846953 https://git.kernel.org/stable/c/fcd86180ef78b0e41763faef7c6d2de7dfb50c1a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:42:16.824Z

Updated: 2026-09-21T13:14:20.481Z

Reserved: 2026-08-26T14:34:25.803Z

Link: CVE-2026-80945

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:00.057

Modified: 2026-09-21T14:17:21.567

Link: CVE-2026-80945

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:16Z

Links: CVE-2026-80945 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T03:00:12Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object