CVE-2025-38300

What it actually does

Incorrect DMA cleanup on error paths in sun8i-ce-cipher driver allows attempts to unmap unallocated or invalid DMA addresses when dma_map_sg or dma_map_single fails.

Why it matters to the business

Kernel warnings, instability or crashes during crypto operations on affected ARM hardware can disrupt systems relying on encryption acceleration, with urgency for organizations running unpatched LTS kernels.

How an attack unfolds

An attacker supplies crypto requests that trigger mapping failures in sun8i_ce_cipher_prepare, forcing execution of flawed error paths that attempt invalid DMA unmaps and produce debug warnings or memory issues.

How to fix it

Upgrade linux-lts (Alpaquita:23) to 6.1.81-r0 or later; linux-lts (Alpaquita:stream) to 6.6.58-r0 or 6.12.41-r0 or later; stable GIT trees to commit a0ac3f85b2e3ef529e852f252a70311f9029d5e6 or later.

How to confirm the fix worked

Confirm updated kernel version; reproduce DMA mapping failure paths and verify absence of check_unmap warnings in dmesg; run crypto self-tests.

Typical attack path

1. Issue crafted crypto request to sun8i-ce driver
2. Force dma_map_sg or dma_map_single failure
3. Trigger theend_sgs or theend_iv error path
4. Observe invalid DMA unmap attempt and resulting warning

How to detect it

Search kernel logs for DMA-API warnings mentioning sun8i-ce and check_unmap; inspect crypto_pump_work and sun8i_ce_cipher_do_one call traces.

• DMA-API: sun8i-ce 1904000.crypto: device driver tries to free an invalid DMA memory address
• check_unmap+0x123c/0x1b90
• sun8i_ce_cipher_do_one+0x1bd4/0x1f40
• Modules linked in: skcipher_example

What your security team should do

• Apply fixed kernel versions immediately on affected hardware
• Enable DMA debug and monitor logs for sun8i-ce warnings
• Restrict untrusted crypto workloads until patched
• Track EPSS rise and related kernel privilege escalations for combined risk