crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.13 % · percentile 2 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer. As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively.
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-66588
- GCVE · GCVE-0-2026-80522
CERT-FR advisories
- CERTFR-2026-AVI-1254 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1232 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < cd6991001bf0681ed0bcf21f9cc3d261d749b2bb ; affected 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < 99a18e1d979e0fad3aaf9c65ae6696897c1d9869 ; affected 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < c6237834d9994de209cb90c7a2c461247bce8e90 ; affected 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < 360f2974fcea49c61f6d6f81554741a9eeee7168 |
| Linux · Linux | affected 6.10 ; unaffected 0 < 6.10 ; unaffected 6.12.105 ≤ 6.12.* ; unaffected 6.18.46 ≤ 6.18.* ; unaffected 7.1.10 ≤ 7.1.* ; unaffected 7.2 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |