EUVD-2026-59427
GHSA-846g-2xvr-929f
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Local hardware-gated error path (AV:L) triggered only on a DMA mapping failure that is hard to force (AC:H), needs local request submission (PR:L); realistic impact is a mapping leak/DoS (A:L), no confirmed C/I.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
The sg_cleanup path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one.
AnalysisAI
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a system physically equipped with Marvell OcteonTX crypto accelerator hardware with the octeontx crypto driver loaded, and (2) reaching the DMA scatter-gather setup error path - the buggy cleanup only runs when a dma_map of an SG entry fails during request processing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is almost certainly an automated over-scoring and conflicts sharply with the actual defect: this is an internal DMA-cleanup error path in a niche hardware crypto driver, not a network-reachable remote-code-execution primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a host equipped with Marvell OcteonTX crypto hardware, an attacker (or workload) that can submit crypto requests repeatedly forces DMA scatter-gather mapping failures - for example under IOMMU/DMA pressure - so the buggy sg_cleanup path leaks mapped entries and mis-unmaps the failed one on each attempt. Sustained over many requests this can exhaust DMA mapping resources and degrade or destabilize the system. … |
| Remediation | Upstream fix available (multiple stable backport commits); update to a patched kernel for your series - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems running Linux with Marvell OcteonTX crypto hardware and the octeontx driver loaded; cross-reference with vulnerability scanning tools for detection of affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today