Cloudanix VulnDB

CVE-2026-80831

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug on certain hardware can make encryption and decryption read or write the wrong amount of data, weakening protection of sensitive information.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

mxs_dcp_aes_block_crypt() calls sg_dma_len() on an unmapped source scatterlist, returning zero or stale values under CONFIG_NEED_SG_DMA_LENGTH=y and causing AES encrypt/decrypt to operate on the wrong byte count.

Why it matters to the business

Cryptographic operations on affected embedded Linux systems may silently produce incorrect ciphertext or plaintext, breaking confidentiality, integrity, and any dependent secure storage or communications.

How an attack unfolds

A local attacker invokes the mxs-dcp AES path (for example via the crypto API or IPsec) on a kernel built with CONFIG_NEED_SG_DMA_LENGTH=y; the missing dma_map_sg() leaves sg_dma_len() invalid so the driver copies or processes an incorrect number of bytes, potentially leaking or corrupting data.

How to fix it

Apply the upstream fix that replaces sg_dma_len() with the original scatterlist length; rebuild and deploy the corrected kernel on all systems using the mxs-dcp driver.

How to confirm the fix worked

Confirm the patch is present by inspecting mxs_dcp_aes_block_crypt() for direct use of sg->length instead of sg_dma_len(), and verify the kernel was compiled without relying on CONFIG_NEED_SG_DMA_LENGTH for this driver.

Typical attack path

  1. Obtain local code execution on target
  2. Trigger mxs-dcp AES encrypt/decrypt via crypto API
  3. Supply scatterlist whose DMA length has not been populated
  4. Observe or abuse resulting incorrect byte count in crypto output

How to detect it

Review kernel logs for mxs-dcp or crypto scatterlist errors, examine system call traces involving AF_ALG or crypto API with AES on mxs-dcp hardware, and look for unexpected short or truncated encrypted blobs in application logs.

What your security team should do

  • Prioritize kernel update on all devices that enable the mxs-dcp driver
  • Audit kernel configs for CONFIG_NEED_SG_DMA_LENGTH=y combined with mxs-dcp
  • Test crypto workloads after patching to ensure correct byte counts
  • Monitor for future scatterlist-related fixes in the same subsystem

The record

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. Therefore, sg_dma_len() is invalid and could return zero or a stale DMA length, causing encryption and decryption to process the wrong number of bytes when CONFIG_NEED_SG_DMA_LENGTH=y. Use the original scatterlist length instead.

Affected packages

Ecosystem Package Introduced Fixed