CVE-2026-74279 (GCVE-0-2026-74279)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:45
VLAI
Title
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sg_cleanup error path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one.
Severity
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 23c6174e48f66fc10b998b0acdb406cb0caf5c80 (git)
Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 23d3a7e896a1fe2d7a6bcb42f093948b79f8a198 (git)
Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 28141f95ae93b18f9bfde953cb787fcb151fb9da (git)
Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 8afd1007ef79898a6e010eaade97097e49405fce (git)
Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 3b8a1e1f4e4071a62b20374028744e8cc8310d48 (git)
Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < fb4d57b83356d4bd411b45ede3024e0ff42c9b5e (git)
Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < d319b83b97b3585550d9ae592dfa78c755b6129e (git)
Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 9dbf173bd32d5f81b005008b682bfb50aa093455 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "23c6174e48f66fc10b998b0acdb406cb0caf5c80",
              "status": "affected",
              "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
              "versionType": "git"
            },
            {
              "lessThan": "23d3a7e896a1fe2d7a6bcb42f093948b79f8a198",
              "status": "affected",
              "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
              "versionType": "git"
            },
            {
              "lessThan": "28141f95ae93b18f9bfde953cb787fcb151fb9da",
              "status": "affected",
              "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
              "versionType": "git"
            },
            {
              "lessThan": "8afd1007ef79898a6e010eaade97097e49405fce",
              "status": "affected",
              "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
              "versionType": "git"
            },
            {
              "lessThan": "3b8a1e1f4e4071a62b20374028744e8cc8310d48",
              "status": "affected",
              "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
              "versionType": "git"
            },
            {
              "lessThan": "fb4d57b83356d4bd411b45ede3024e0ff42c9b5e",
              "status": "affected",
              "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
              "versionType": "git"
            },
            {
              "lessThan": "d319b83b97b3585550d9ae592dfa78c755b6129e",
              "status": "affected",
              "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
              "versionType": "git"
            },
            {
              "lessThan": "9dbf173bd32d5f81b005008b682bfb50aa093455",
              "status": "affected",
              "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: cavium/cpt - fix DMA cleanup using wrong loop index\n\nThe sg_cleanup error path used list[i] instead of list[j] when unmapping\nDMA buffers, leaking successfully mapped entries and repeatedly unmapping\nthe failed one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On Cavium Thunder appliances the CPT VF skcipher driver is selected for in-kernel crypto on network-facing workloads (IPsec/xfrm ESP decrypt, NFS/RPC GSS-Kerberos), so remote peers can drive setup_sgio_components() by sending traffic that triggers hardware-accelerated AES/DES operations.\nAC:L - An attacker can reliably force the error path by fragmenting crypto buffers to raise incnt/outcnt and flooding concurrent encrypt/decrypt requests to exhaust IOMMU IOVAs, causing dma_map_single() to fail mid-loop; no uncontrollable victim state or race is required.\nPR:N - Exploitation requires no root or capabilities on the victim host; remote network peers sending IPsec or authenticated RPC traffic, or any local process using the kernel crypto API via AF_ALG sockets, can trigger the faulty DMA cleanup without admin privileges.\nUI:N - Exploitation is fully attacker-driven through automated network traffic or programmatic crypto requests and does not require any victim user action such as opening files or mounting filesystems.\nS:C - Leaked DMA mappings let the CPT PCI function continue bus-mastering kernel pages after software teardown, bypassing intended kernel DMA lifecycle and IOMMU-enforced device isolation boundaries when stale mappings target freed or repurposed memory.\nC:H - Unmapping failures leave active DMA translations while dma_addr metadata is cleared, allowing the CPT hardware to read kernel memory from freed or reallocated pages, providing a memory-corruption primitive that can disclose sensitive data.\nI:H - Stale bidirectional DMA mappings combined with bogus unmaps on DMA_MAPPING_ERROR can corrupt IOMMU state and let the accelerator write into kernel pages no longer owned by the request, enabling control of kernel memory contents.\nA:H - Repeated dma_unmap_single() on DMA_MAPPING_ERROR triggers WARN_ON in iommu_dma_unmap_phys, and accumulating leaked IOMMU mappings can exhaust DMA resources or panic the kernel during subsequent crypto operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:20.085Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/23c6174e48f66fc10b998b0acdb406cb0caf5c80"
        },
        {
          "url": "https://git.kernel.org/stable/c/23d3a7e896a1fe2d7a6bcb42f093948b79f8a198"
        },
        {
          "url": "https://git.kernel.org/stable/c/28141f95ae93b18f9bfde953cb787fcb151fb9da"
        },
        {
          "url": "https://git.kernel.org/stable/c/8afd1007ef79898a6e010eaade97097e49405fce"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b8a1e1f4e4071a62b20374028744e8cc8310d48"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb4d57b83356d4bd411b45ede3024e0ff42c9b5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d319b83b97b3585550d9ae592dfa78c755b6129e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9dbf173bd32d5f81b005008b682bfb50aa093455"
        }
      ],
      "title": "crypto: cavium/cpt - fix DMA cleanup using wrong loop index",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74279",
    "datePublished": "2026-08-15T05:57:50.131Z",
    "dateReserved": "2026-08-15T05:44:03.880Z",
    "dateUpdated": "2026-08-17T05:45:20.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74279",
      "date": "2026-09-21",
      "epss": "0.00514",
      "percentile": "0.42636"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "23c6174e48f66fc10b998b0acdb406cb0caf5c80",
                    "status": "affected",
                    "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "23d3a7e896a1fe2d7a6bcb42f093948b79f8a198",
                    "status": "affected",
                    "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "28141f95ae93b18f9bfde953cb787fcb151fb9da",
                    "status": "affected",
                    "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8afd1007ef79898a6e010eaade97097e49405fce",
                    "status": "affected",
                    "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b8a1e1f4e4071a62b20374028744e8cc8310d48",
                    "status": "affected",
                    "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fb4d57b83356d4bd411b45ede3024e0ff42c9b5e",
                    "status": "affected",
                    "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d319b83b97b3585550d9ae592dfa78c755b6129e",
                    "status": "affected",
                    "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9dbf173bd32d5f81b005008b682bfb50aa093455",
                    "status": "affected",
                    "version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.11"
                  },
                  {
                    "lessThan": "4.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: cavium/cpt - fix DMA cleanup using wrong loop index\n\nThe sg_cleanup error path used list[i] instead of list[j] when unmapping\nDMA buffers, leaking successfully mapped entries and repeatedly unmapping\nthe failed one."
          }
        ],
        "id": "CVE-2026-74279",
        "lastModified": "2026-08-17T06:19:21.603",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 10.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:27.317",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/23c6174e48f66fc10b998b0acdb406cb0caf5c80"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/23d3a7e896a1fe2d7a6bcb42f093948b79f8a198"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/28141f95ae93b18f9bfde953cb787fcb151fb9da"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3b8a1e1f4e4071a62b20374028744e8cc8310d48"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8afd1007ef79898a6e010eaade97097e49405fce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9dbf173bd32d5f81b005008b682bfb50aa093455"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d319b83b97b3585550d9ae592dfa78c755b6129e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fb4d57b83356d4bd411b45ede3024e0ff42c9b5e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T15:18:55+00:00",
      "cve": "CVE-2026-74279",
      "id": "CVE-2026-74279",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: crypto: cavium/cpt - fix DMA cleanup using wrong loop index",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74279.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:23:37Z",
      "cve": "CVE-2026-74279",
      "id": "CVE-2026-74279",
      "initial_release_date": "2026-08-26T01:13:58Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "97",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74279",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74279.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.