In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware… (CVE-2026-80945)
A vulnerability in the Linux kernel's crypto iaa component was resolved involving improper unmapping of the destination buffer before falling back to software decompression. The issue occurs when a hardware analytics error triggers a software fallback that writes to a destination buffer still mapped for DMA, causing stale data to overwrite the result when SWIOTLB is active.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel crypto iaa module involves the failure to unmap the destination buffer (req->dst) before retrying decompression via software fallback after a hardware analytics error. When SWIOTLB is active, the dma_unmap_sg() operation copies stale bounce buffer data over req->dst, corrupting the decompression output. The fix ensures that the buffer is unmapped before the fallback decompress runs, preventing data corruption. The asynchronous path unmaps inline, while the synchronous path signals a retry with -EAGAIN and runs the fallback after unmapping.
Potential Impact
This vulnerability can lead to corrupted decompression results due to stale DMA bounce buffer data overwriting the destination buffer during software fallback decompression. This may affect data integrity in cryptographic operations relying on the iaa decompression path.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to unmap the destination buffer before software fallback decompression runs. Users should update to the fixed kernel version once available. No additional mitigation is indicated.
In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware… (CVE-2026-80945)
Description
A vulnerability in the Linux kernel's crypto iaa component was resolved involving improper unmapping of the destination buffer before falling back to software decompression. The issue occurs when a hardware analytics error triggers a software fallback that writes to a destination buffer still mapped for DMA, causing stale data to overwrite the result when SWIOTLB is active.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel crypto iaa module involves the failure to unmap the destination buffer (req->dst) before retrying decompression via software fallback after a hardware analytics error. When SWIOTLB is active, the dma_unmap_sg() operation copies stale bounce buffer data over req->dst, corrupting the decompression output. The fix ensures that the buffer is unmapped before the fallback decompress runs, preventing data corruption. The asynchronous path unmaps inline, while the synchronous path signals a retry with -EAGAIN and runs the fallback after unmapping.
Potential Impact
This vulnerability can lead to corrupted decompression results due to stale DMA bounce buffer data overwriting the destination buffer during software fallback decompression. This may affect data integrity in cryptographic operations relying on the iaa decompression path.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to unmap the destination buffer before software fallback decompression runs. Users should update to the fixed kernel version once available. No additional mitigation is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-p5w3-q665-q5v8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-80945"]
Threat ID: 6aa4a03055bf5e2cf5a871f2
Added to database: 09/12/2026, 00:43:28 UTC
Last enriched: 09/12/2026, 01:25:58 UTC
Last updated: 09/12/2026, 02:21:29 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.