CVE-2026-80522

HighCVSS 7.8/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()

Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer.

As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0, < cd6991001bf0681ed0bcf21f9cc3d261d749b2bb; >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0, < 99a18e1d979e0fad3aaf9c65ae6696897c1d9869; >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0, < c6237834d9994de209cb90c7a2c461247bce8e90; >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0, < 360f2974fcea49c61f6d6f81554741a9eeee7168
LinuxLinux6.10

References

Timeline

Published
Aug 26, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-805237.1In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsiblCVE-2026-80524In the Linux kernel, the following vulnerability has been resolved: optee: ffa: Add NULL check in optee_ffa_lend_protmem Sashiko (locally)CVE-2026-80525In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setuCVE-2026-805267.8In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562_volume_controCVE-2026-805277.5In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale mds_wanted A reader canCVE-2026-805289.8In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handle_reply(CVE-2026-80529In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlog_recover_dquCVE-2026-80538.8An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger anCVE-2026-805307.1In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN CVE-2026-805317.8In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc->tempip in xrep_tempfile_create LOLLM noticed a pCVE-2026-80532In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infinite loop bug in online fsck xrep_iunlinkCVE-2026-80533In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair LOLL
CVE-2026-80522: High severity, CVSS 7.8 | Vulnix