CVE-2026-80945
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
11/09/2026
Last modified:
21/09/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
crypto: iaa - unmap dst before software fallback on decompress<br />
<br />
On a hardware analytics error, decompress retries through the software<br />
fallback, which writes req->dst with the CPU while it is still mapped<br />
DMA_FROM_DEVICE. With SWIOTLB active the later dma_unmap_sg() copies the<br />
stale bounce buffer over req->dst, corrupting the result.<br />
<br />
Unmap before the fallback runs. The async path unmaps inline; the sync<br />
path signals the retry with -EAGAIN so iaa_comp_adecompress() runs the<br />
fallback after unmapping.
Impact
Base Score 3.x
9.10
Severity 3.x
CRITICAL