CVE-2026-80831
Received Received - Intake

crypto: mxs-dcp scatterlist length access flaw in Linux kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. Therefore, sg_dma_len() is invalid and could return zero or a stale DMA length, causing encryption and decryption to process the wrong number of bytes when CONFIG_NEED_SG_DMA_LENGTH=y. Use the original scatterlist length instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80831
EUVD
EUVD-2026-71281

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Linux kernel's crypto subsystem, specifically the mxs-dcp driver. It involves incorrect handling of scatterlist lengths during AES encryption and decryption operations. The function mxs_dcp_aes_block_crypt() uses sg_dma_len() without properly mapping the source scatterlist with dma_map_sg(), leading to potential invalid DMA length values.

Detection Guidance

This vulnerability is specific to the Linux kernel's mxs-dcp crypto module and does not have network-based detection methods. It requires checking kernel code or logs for improper scatterlist handling in the mxs-dcp driver. No direct commands can detect this remotely.

Impact Analysis

This flaw could cause encryption and decryption operations to process incorrect amounts of data, potentially resulting in data corruption or security failures. Systems relying on AES encryption via the mxs-dcp driver may experience failures in secure data handling when CONFIG_NEED_SG_DMA_LENGTH is enabled.

Mitigation Strategies

Update your Linux kernel to a patched version where this issue is resolved. The fix involves using the original scatterlist length instead of sg_dma_len(). Check your distribution's security updates or kernel patches for CVE-2026-80831.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80831. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart