Linux Kernel CVE-2026-74280

Exploitation requires (1) a system physically equipped with Marvell OcteonTX crypto accelerator hardware with the octeontx crypto driver loaded, and (2) reaching the DMA scatter-gather setup error path - the buggy cleanup only runs when a dma_map of an SG entry fails during request processing. This is a local, hardware-gated kernel error path, not a default-reachable remote surface; despite the CVSS AV:N/PR:N vector there is no evidence of network-triggerable unauthenticated exploitation. Limiting factors: the specific SoC/hardware must be present, the driver must be in use, and a mapping failure must be induced, so the vast majority of Linux deployments cannot reach this code at all.

The published CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is almost certainly an automated over-scoring and conflicts sharply with the actual defect: this is an internal DMA-cleanup error path in a niche hardware crypto driver, not a network-reachable remote-code-execution primitive. The AV:N (network) and PR:N (unauthenticated) metrics are not supported by the description, which describes a local kernel driver error path that only triggers when a DMA mapping fails on a system that physically has Marvell OcteonTX crypto hardware - verify with the vendor, as CVSS implies remote unauthenticated access while the code implies local, hardware-gated conditions. Corroborating signals point to low real-world urgency: EPSS is only 0.21% (12th percentile), there is no CISA KEV listing, and no POC is referenced. The realistic impact is a DMA/memory-mapping leak and potential denial of service or resource exhaustion, not confidentiality/integrity compromise at the level the vector claims. Practically, this is a fix-in-normal-patch-cycle kernel hygiene issue for the specific subset of deployments running OcteonTX hardware, and organizations without that hardware are effectively unaffected regardless of the headline score.

On a host equipped with Marvell OcteonTX crypto hardware, an attacker (or workload) that can submit crypto requests repeatedly forces DMA scatter-gather mapping failures - for example under IOMMU/DMA pressure - so the buggy sg_cleanup path leaks mapped entries and mis-unmaps the failed one on each attempt. Sustained over many requests this can exhaust DMA mapping resources and degrade or destabilize the system. No public exploit code exists, and the attacker needs local access to the specific hardware, making practical exploitation limited and non-trivial.