CVE-2026-80522
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer. As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively.
How to fix
- Linux Linuxcd6991001bf0681ed0bcf21f9cc3d261d749b2bb, 99a18e1d979e0fad3aaf9c65ae6696897c1d9869, c6237834d9994de209cb90c7a2c461247bce8e90, 360f2974fcea49c61f6d6f81554741a9eeee7168 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 ≤ v < cd6991001bf0681ed0bcf21f9cc3d261d749b2bb, 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 ≤ v < 99a18e1d979e0fad3aaf9c65ae6696897c1d9869, 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 ≤ v < c6237834d9994de209cb90c7a2c461247bce8e90, 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 ≤ v < 360f2974fcea49c61f6d6f81554741a9eeee7168, 6.10 | cd6991001bf0681ed0bcf21f9cc3d261d749b2bb, 99a18e1d979e0fad3aaf9c65ae6696897c1d9869, c6237834d9994de209cb90c7a2c461247bce8e90, 360f2974fcea49c61f6d6f81554741a9eeee7168 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.