HIGH Introduced in 3.14
mxs-dcp Scatterlist OOB
CVE-2026-80831
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. Therefore, sg_dma_len() is invalid and could return zero or a stale DMA length, causing encryption and decryption to process the wrong number of bytes when CONFIG_NEED_SG_DMA_LENGTH=y. Use the original scatterlist length instead.
02KernelScan AI Analysis
Risk summary
The Freescale MXS DCP crypto driver uses an invalid scatterlist length when processing AES encryption/decryption requests, causing the wrong number of bytes to be processed. This can corrupt cryptographic output and potentially cause out-of-bounds memory access on systems with CONFIG_NEED_SG_DMA_LENGTH=y. Any local user with access to the crypto subsystem can trigger this.
Vulnerability analysis
The DCP crypto driver reads the DMA-mapped length of a source scatterlist entry before the scatterlist has been DMA-mapped, so the length field is uninitialized or stale. This causes the AES block cipher operation to process the wrong number of bytes, potentially reading or writing beyond the intended buffer boundaries. The fix switches to using the original scatterlist length field, which is always valid regardless of DMA mapping state. The vulnerable code path is reachable by any local user who can submit cryptographic requests through the kernel crypto framework on systems with the MXS DCP hardware enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.14 | 5.10.269 | fd0f211b27a6 |
| 5.15 | 3.14 | 5.15.220 | 04201dcc88b2 |
| 6.1 | 3.14 | 6.1.187 | e72a795df521 |
| 6.12 | 3.14 | 6.12.108 | da14fae5203b |
| 6.18 | 3.14 | 6.18.49 | 182f16a20d32 |
| 6.6 | 3.14 | 6.6.156 | 1537bd55b4f8 |
| 7.1 | 3.14 | 7.1.13 | 0e9edb108a63 |
| 7.2 | 3.14 | 7.2.3 | 6ef9a4afb52c |
| mainline | 3.14 | 7.3 | c5bcb084a987 |
| cip/5.10 | 3.14 | 5.10.271-cip78 | fd0f211b27a6 |
| cip/6.1 | 3.14 | 6.1.187-cip60 | e72a795df521 |
| cip/6.1-rt | 3.14 | 6.1.189-cip61-rt32 | e72a795df521 |
| cip/6.12 | 3.14 | 6.12.108-cip31 | da14fae5203b |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |