Out-of-Bounds Read Vulnerability in Linux Kernel Affecting Crypto Functionality

CVE-2026-80836

What is CVE-2026-80836?

An out-of-bounds read vulnerability exists within the Linux kernel's virtio crypto functionality. Specifically, the virtio_crypto_dataq_akcipher_callback function fails to properly bound the length of the result derived from the device-reported response. This oversight allows an attacker with control over the backend device to report a larger length than expected. Consequently, when sg_copy_from_buffer attempts to read this unbounded length, it may inadvertently access adjacent memory in the kernel heap, leading to potential disclosure of sensitive data. To mitigate this risk, the reported response length is now clamped to the originally requested destination length, ensuring that compliant devices do not expose this vulnerability.

References