CVE-2026-93158

What it actually does

The probe routine ignores the failure return from context DMA pool allocation, allowing subsequent DMA setup, algorithm registration, and child device population to proceed with an uninitialized or null pool that later request handling depends on.

Why it matters to the business

Hardware-accelerated cryptographic operations on affected systems may fail or cause kernel instability when memory allocation for security contexts fails during driver initialization, reducing reliability of encryption workloads.

How an attack unfolds

An attacker with local access induces pool creation failure (via memory pressure or similar) during sa2ul probe; the driver continues initialization anyway, so subsequent crypto requests dereference the invalid pool and trigger crashes or memory corruption.

How to fix it

Apply the upstream fix that makes sa_ul_probe check the sa_init_mem return value, abort on failure, and route errors through the proper PM cleanup path without attempting to destroy a nonexistent pool; update to a kernel containing the resolution once released.

How to confirm the fix worked

Confirm that sa_ul_probe returns an error code when sa_init_mem fails and that no algorithm registration or child population occurs afterward; inspect dmesg for explicit probe failure messages instead of silent continuation.

Typical attack path

1. Gain local access to trigger or observe driver probe
2. Create conditions that cause sa_init_mem to fail
3. Initiate cryptographic requests that rely on the missing pool
4. Trigger kernel fault or undefined behavior

How to detect it

Search kernel logs and dmesg for sa2ul probe messages that lack explicit failure handling or that mention context pool creation errors; correlate with subsequent crypto request faults.

What your security team should do

• Track Linux kernel updates for the sa2ul probe fix
• Test cryptographic acceleration on systems using the sa2ul driver under memory-constrained conditions
• Review kernel logs for sa2ul probe and DMA pool errors as an early indicator of exposure