EUVD-2026-76268
GHSA-p5w3-q665-q5v8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Local crypto path gated on IAA hardware, SWIOTLB, and a hardware error (AV:L/AC:H/PR:L); impact is silent output corruption (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
crypto: iaa - unmap dst before software fallback on decompress
On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMA_FROM_DEVICE. With SWIOTLB active the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result.
Unmap before the fallback runs. The async path unmaps inline; the sync path signals the retry with -EAGAIN so iaa_comp_adecompress() runs the fallback after unmapping.
AnalysisAI
Decompression result corruption in the Linux kernel's Intel IAA (In-Memory Analytics Accelerator) crypto driver (iaa_crypto) occurs when a hardware analytics error forces a software fallback that writes the destination buffer with the CPU while it is still mapped DMA_FROM_DEVICE; with SWIOTLB active, the subsequent dma_unmap_sg() overwrites req->dst with the stale bounce buffer, corrupting the decompressed output. The issue was resolved upstream and affects kernels from ~6.8 through the fixed releases. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an affected host running the Linux iaa_crypto driver with Intel IAA accelerator hardware present and in use for decompression, SWIOTLB (bounce-buffer DMA) active, and a hardware analytics error that forces the software fallback on the decompress path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) is substantially overstated and internally inconsistent with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 6.18.51, 7.2.4, or 7.3-rc1 (or a distribution kernel incorporating stable commits 94a25930477113730372e0fa2985da4c5ac95c9a / fc933a4a419ba8a75da28666a018602c44846953 / fcd86180ef78b0e41763faef7c6d2de7dfb50c1a), which unmap the destination before the software fallback runs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux hosts using Intel IAA hardware with kernel versions 6.8 through the latest affected release and flag for prioritized patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today