EUVD-2026-66588
GHSA-fhv2-cf5f-4mpm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges to the crypto API is sufficient; out-of-bounds kernel write yields full C/I/A impact with no user interaction.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer.
As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively.
AnalysisAI
Out-of-bounds write in the Linux kernel's Tegra hardware crypto driver affects AES-GCM decrypt operations on NVIDIA Tegra SoC-based systems running kernel 6.10 and later. When a caller skips invocation of tegra_gcm_setauthsize() - leaving ctx->authsize at zero - the rctx->cryptlen calculation in tegra_gcm_do_one_req() produces an inflated length that causes a subsequent decrypt operation to write beyond the rctx->dst_sg scatter-gather buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local access to a system running on NVIDIA Tegra SoC hardware with the tegra-aes kernel crypto driver loaded; (2) low-privilege (standard user) access sufficient to open AF_ALG sockets or otherwise submit requests to the kernel crypto API; (3) the ability to issue an AES-GCM decrypt request without a prior setauthsize call, leaving ctx->authsize at zero - this is an abnormal API usage pattern that a controlled attacker can deliberately engineer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a locally exploitable kernel memory-corruption primitive with high impact across all three pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a standard user account on a Tegra Jetson or similar embedded Linux system opens an AF_ALG socket configured for AES-GCM using the Tegra hardware driver, deliberately omits the AEAD setsockopt call that would invoke tegra_gcm_setauthsize(), then submits an AEAD decrypt operation. The miscalculated rctx->cryptlen causes the DMA completion handler to write decrypted data beyond the allocated destination scatter-gather buffer, overwriting adjacent kernel memory structures and providing a potential path to privilege escalation or kernel panic. … |
| Remediation | The primary remediation is to update the Linux kernel to a patched stable release: 6.12.105 or later on the 6.12.x branch, 6.18.46 or later on the 6.18.x branch, 7.1.10 or later on the 7.1.x branch, or any 7.2+ mainline release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Linux kernel 6.10 or later on NVIDIA Tegra hardware and evaluate local user access scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today