Look up another CVE · open CVE-2026-74279 in the interactive tracker
CVE-2026-74279
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/crypto. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74279 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The sg_cleanup error path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/crypto/cavium/cpt/cptvf_reqmanager.c
- What this is
- CAVIUM OCTEON-TX CRYPTO DRIVERMAINTAINERS section matched on drivers/crypto/cavium/cpt/ · linux-crypto@vger.kernel.org · Supported
- Kernel module
- cptvf
Check it on the machine
grep -wE 'CONFIG_CAVIUM_CPT|CONFIG_CRYPTO|CONFIG_CRYPTO_DEV_CAVIUM_ZIP|CONFIG_CRYPTO_DEV_CPT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cptvfPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 2 releases. It does build it in 2 releases, so the answer depends on which release the machine runs.
- bookworm, trixien
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- n
- not enabled on any flavour - this release does not build the code
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_CAVIUM_CPT, CONFIG_CRYPTO, CONFIG_CRYPTO_DEV_CAVIUM_ZIP, CONFIG_CRYPTO_DEV_CPT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 10.0 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.76%, higher than 54.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/crypto
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.11 | 5.10.261 | 23c6174e48f6 |
| 4.11 | 5.15.212 | 23d3a7e896a1 |
| 4.11 | 6.1.178 | 28141f95ae93 |
| 4.11 | 6.6.145 | 8afd1007ef79 |
| 4.11 | 6.12.97 | 3b8a1e1f4e40 |
| 4.11 | 6.18.40 | fb4d57b83356 |
| 4.11 | 7.1.5 | d319b83b97b3 |
| 4.11 | 7.2 | 9dbf173bd32d |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- On Cavium Thunder appliances the CPT VF skcipher driver is selected for in-kernel crypto on network-facing workloads (IPsec/xfrm ESP decrypt, NFS/RPC GSS-Kerberos), so remote peers can drive setup_sgio_components() by sending traffic that triggers hardware-accelerated AES/DES operations.
- AC:LAttack complexity, low
- An attacker can reliably force the error path by fragmenting crypto buffers to raise incnt/outcnt and flooding concurrent encrypt/decrypt requests to exhaust IOMMU IOVAs, causing dma_map_single() to fail mid-loop; no uncontrollable victim state or race is required.
- PR:NPrivileges required, none
- Exploitation requires no root or capabilities on the victim host; remote network peers sending IPsec or authenticated RPC traffic, or any local process using the kernel crypto API via AF_ALG sockets, can trigger the faulty DMA cleanup without admin privileges.
- UI:NUser interaction, none
- Exploitation is fully attacker-driven through automated network traffic or programmatic crypto requests and does not require any victim user action such as opening files or mounting filesystems.
- S:CScope, changed
- Leaked DMA mappings let the CPT PCI function continue bus-mastering kernel pages after software teardown, bypassing intended kernel DMA lifecycle and IOMMU-enforced device isolation boundaries when stale mappings target freed or repurposed memory.
- C:HConfidentiality impact, high
- Unmapping failures leave active DMA translations while dma_addr metadata is cleared, allowing the CPT hardware to read kernel memory from freed or reallocated pages, providing a memory-corruption primitive that can disclose sensitive data.
- I:HIntegrity impact, high
- Stale bidirectional DMA mappings combined with bogus unmaps on DMA_MAPPING_ERROR can corrupt IOMMU state and let the accelerator write into kernel pages no longer owned by the request, enabling control of kernel memory contents.
- A:HAvailability impact, high
- Repeated dma_unmap_single() on DMA_MAPPING_ERROR triggers WARN_ON in iommu_dma_unmap_phys, and accumulating leaked IOMMU mappings can exhaust DMA resources or panic the kernel during subsequent crypto operations.