CVE-2026-80522
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
26/08/2026
Last modified:
27/08/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()<br />
<br />
Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way<br />
it is done in tegra_ccm_crypt_init(). The current formulae may lead to a<br />
crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize<br />
remains zero. Then a decrypt operation with incorrect rctx->cryptlen will<br />
lead to a write beyound rctx->dst_sg buffer.<br />
<br />
As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since<br />
it appears to be completely unused. Also simplify tegra_ccm_setauthsize()<br />
and tegra_gcm_setauthsize() functions respectively.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH