CVE-2026-80522
Received Received - Intake

Buffer Overflow Fix in Linux Kernel Crypto Subsystem

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer. As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80522
EUVD
EUVD-2026-66588

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's crypto subsystem, specifically in the Tegra cryptographic driver. It involves an incorrect calculation of the cryptlen field in the tegra_gcm_do_one_req() function. If a caller does not set the authentication size, the calculation can lead to a buffer overflow during decryption, potentially causing a system crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem, particularly in the Tegra cryptographic driver. Detection requires checking the kernel version and whether the affected code path is present. Examine kernel logs for crashes related to tegra_gcm_do_one_req() or tegra_ccm_crypt_init(). Use commands like 'dmesg | grep tegra' or 'grep -r tegra_gcm_do_one_req /proc/kallsyms' to identify vulnerable code paths.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system if they can trigger a decrypt operation with an incorrect buffer length. It may also lead to memory corruption or other unintended behavior in affected systems.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that resolves this issue. If updating is not immediately possible, disable the Tegra cryptographic driver by blacklisting the module or recompiling the kernel without the affected driver. Monitor kernel logs for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80522. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart