CRITICAL Introduced in 5.7
octeontx SgCleanup Leak
CVE-2026-74280
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sg_cleanup path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one.
02KernelScan AI Analysis
Risk summary
A wrong loop index in the DMA cleanup error path of the Marvell OcteonTX crypto driver causes DMA mappings to leak when a mapping fails partway through setup. Local unprivileged users on systems with this specific hardware can reach the vulnerable code through the kernel crypto API, potentially exhausting DMA resources over repeated triggers and causing inconsistent DMA state.
Vulnerability analysis
When a scatter-gather DMA mapping fails partway through buffer setup, the error cleanup path in the Marvell OcteonTX crypto driver is supposed to unmap all previously successful mappings. Instead, it uses the wrong loop index, repeatedly referencing the failed entry while never unmapping the valid ones. This leaks DMA mappings for every successfully mapped buffer and performs repeated invalid DMA unmap operations on the failed entry. The fix corrects the loop index so each successfully mapped buffer is properly unmapped during cleanup. The vulnerable path is reachable from local userspace through the kernel crypto API (AF_ALG sockets) on systems equipped with Marvell OcteonTX 83XX hardware, requiring no special privileges to trigger crypto operations.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.7 | 5.10.261 | 97f150ba3e37 |
| 5.15 | 5.7 | 5.15.212 | 8a0db9fad3c9 |
| 6.1 | 5.7 | 6.1.178 | 8d301e5a5117 |
| 6.12 | 5.7 | 6.12.97 | 6c721a3e4334 |
| 6.18 | 5.7 | 6.18.40 | 5f99a396f706 |
| 6.6 | 5.7 | 6.6.145 | ed374dbc70c1 |
| 7.1 | 5.7 | 7.1.5 | acff30cfc0d7 |
| mainline | 5.7 | 7.2 | 7891c64c0520 |
| cip/5.10 | 5.7 | 5.10.263-cip76 | 97f150ba3e37 |
| cip/5.10-rt | 5.7 | 5.10.268-cip77-rt34 | 97f150ba3e37 |
| cip/6.1 | 5.7 | 6.1.182-cip59 | 8d301e5a5117 |
| cip/6.1-rt | 5.7 | 6.1.182-cip59-rt31 | 8d301e5a5117 |
| cip/6.12 | 5.7 | 6.12.101-cip29 | 6c721a3e4334 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.182-cip59 |
| cip/6.1-rt | Fixed in 6.1.182-cip59-rt31 |
| cip/5.10 | Fixed in 5.10.263-cip76 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |