Buffer Underallocation in Linux Kernel's Crypto Module Affects QCE Hardware

CVE-2026-80832

What is CVE-2026-80832?

A vulnerability exists in the Linux kernel's crypto module, specifically within the QCE (Qualcomm Cryptographic Engine) hardware implementation. The issue arises from a buffer underallocation in the ccm_prepare_buf_assoclen function, where the allocated AAD (Additional Authenticated Data) buffer is insufficient for the expected DMA (Direct Memory Access) length, leading to potential memory overflow scenarios. This can result in invalid authentication tags and consequential failures in encryption tests. The proper allocation logic was corrected to ensure that the buffer size adequately accommodates the maximum AAD header length, preventing any overflow and ensuring robust cryptographic operations.

References