EUVD-2026-59426
GHSA-4p2p-ww9m-h8rq
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Local hardware-gated error path (AV:L), only under DMA-failure conditions (AC:H), requires local privilege to drive offload (PR:L); impact is a resource leak affecting availability (A:L), no C/I loss.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
The sg_cleanup error path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one.
AnalysisAI
Resource-leak and repeated-unmap defect in the Linux kernel's Cavium/Marvell CPT cryptographic accelerator driver (crypto/cavium/cpt) mishandles its DMA error-cleanup path, using the outer loop index (list[i]) instead of the inner index (list[j]) so that successfully mapped scatter-gather entries leak while the single failed entry is unmapped repeatedly. It affects only systems running the cavium CPT driver against OcteonTX CPT hardware, is reachable solely when a DMA mapping failure occurs during request setup, and is a local reliability/resource-management bug rather than a remotely exploitable code-execution flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target run the Linux cavium CPT crypto driver on physical OcteonTX CPT accelerator hardware, and that a DMA buffer mapping failure occur during crypto request setup - the error-cleanup path is the only place the wrong index (list[i] vs list[j]) executes, so on a healthy system with successful mappings the bug is never reached. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is a Linux-CNA-style worst-case placeholder and is strongly contradicted by the description: the bug lives in an error path of a specific hardware crypto driver, requires that hardware to be present, and only triggers on a DMA mapping failure - it is neither network-reachable nor a confidentiality/integrity compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local process on a host equipped with a Cavium/OcteonTX CPT accelerator drives repeated crypto offload requests under memory pressure so that dma_map operations intermittently fail, causing the buggy cleanup path to leak DMA-mapped buffers on each failure. Over time this exhausts DMA/IOMMU mapping resources and degrades or destabilizes crypto offload and the host. … |
| Remediation | Vendor-released patch: update to a fixed Linux stable release for your branch - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (mainline ~7.2-rc1) - via your distribution's kernel update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems running the Cavium/Marvell CPT driver with OcteonTX hardware and review system logs for recent DMA mapping errors. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today