{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74279", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.880Z", "datePublished": "2026-08-15T05:57:50.131Z", "dateUpdated": "2026-08-17T05:45:20.085Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:20.085Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: cavium/cpt - fix DMA cleanup using wrong loop index\n\nThe sg_cleanup error path used list[i] instead of list[j] when unmapping\nDMA buffers, leaking successfully mapped entries and repeatedly unmapping\nthe failed one."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - On Cavium Thunder appliances the CPT VF skcipher driver is selected for in-kernel crypto on network-facing workloads (IPsec/xfrm ESP decrypt, NFS/RPC GSS-Kerberos), so remote peers can drive setup_sgio_components() by sending traffic that triggers hardware-accelerated AES/DES operations.\nAC:L - An attacker can reliably force the error path by fragmenting crypto buffers to raise incnt/outcnt and flooding concurrent encrypt/decrypt requests to exhaust IOMMU IOVAs, causing dma_map_single() to fail mid-loop; no uncontrollable victim state or race is required.\nPR:N - Exploitation requires no root or capabilities on the victim host; remote network peers sending IPsec or authenticated RPC traffic, or any local process using the kernel crypto API via AF_ALG sockets, can trigger the faulty DMA cleanup without admin privileges.\nUI:N - Exploitation is fully attacker-driven through automated network traffic or programmatic crypto requests and does not require any victim user action such as opening files or mounting filesystems.\nS:C - Leaked DMA mappings let the CPT PCI function continue bus-mastering kernel pages after software teardown, bypassing intended kernel DMA lifecycle and IOMMU-enforced device isolation boundaries when stale mappings target freed or repurposed memory.\nC:H - Unmapping failures leave active DMA translations while dma_addr metadata is cleared, allowing the CPT hardware to read kernel memory from freed or reallocated pages, providing a memory-corruption primitive that can disclose sensitive data.\nI:H - Stale bidirectional DMA mappings combined with bogus unmaps on DMA_MAPPING_ERROR can corrupt IOMMU state and let the accelerator write into kernel pages no longer owned by the request, enabling control of kernel memory contents.\nA:H - Repeated dma_unmap_single() on DMA_MAPPING_ERROR triggers WARN_ON in iommu_dma_unmap_phys, and accumulating leaked IOMMU mappings can exhaust DMA resources or panic the kernel during subsequent crypto operations."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/cavium/cpt/cptvf_reqmanager.c"], "versions": [{"version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "lessThan": "23c6174e48f66fc10b998b0acdb406cb0caf5c80", "status": "affected", "versionType": "git"}, {"version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "lessThan": "23d3a7e896a1fe2d7a6bcb42f093948b79f8a198", "status": "affected", "versionType": "git"}, {"version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "lessThan": "28141f95ae93b18f9bfde953cb787fcb151fb9da", "status": "affected", "versionType": "git"}, {"version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "lessThan": "8afd1007ef79898a6e010eaade97097e49405fce", "status": "affected", "versionType": "git"}, {"version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "lessThan": "3b8a1e1f4e4071a62b20374028744e8cc8310d48", "status": "affected", "versionType": "git"}, {"version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "lessThan": "fb4d57b83356d4bd411b45ede3024e0ff42c9b5e", "status": "affected", "versionType": "git"}, {"version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "lessThan": "d319b83b97b3585550d9ae592dfa78c755b6129e", "status": "affected", "versionType": "git"}, {"version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "lessThan": "9dbf173bd32d5f81b005008b682bfb50aa093455", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/cavium/cpt/cptvf_reqmanager.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/23c6174e48f66fc10b998b0acdb406cb0caf5c80"}, {"url": "https://git.kernel.org/stable/c/23d3a7e896a1fe2d7a6bcb42f093948b79f8a198"}, {"url": "https://git.kernel.org/stable/c/28141f95ae93b18f9bfde953cb787fcb151fb9da"}, {"url": "https://git.kernel.org/stable/c/8afd1007ef79898a6e010eaade97097e49405fce"}, {"url": "https://git.kernel.org/stable/c/3b8a1e1f4e4071a62b20374028744e8cc8310d48"}, {"url": "https://git.kernel.org/stable/c/fb4d57b83356d4bd411b45ede3024e0ff42c9b5e"}, {"url": "https://git.kernel.org/stable/c/d319b83b97b3585550d9ae592dfa78c755b6129e"}, {"url": "https://git.kernel.org/stable/c/9dbf173bd32d5f81b005008b682bfb50aa093455"}], "title": "crypto: cavium/cpt - fix DMA cleanup using wrong loop index", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/crypto/cavium/cpt/cptvf_reqmanager.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "23c6174e48f66fc10b998b0acdb406cb0caf5c80", "status": "affected", "version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "versionType": "git"}, {"lessThan": "23d3a7e896a1fe2d7a6bcb42f093948b79f8a198", "status": "affected", "version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "versionType": "git"}, {"lessThan": "28141f95ae93b18f9bfde953cb787fcb151fb9da", "status": "affected", "version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "versionType": "git"}, {"lessThan": "8afd1007ef79898a6e010eaade97097e49405fce", "status": "affected", "version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "versionType": "git"}, {"lessThan": "3b8a1e1f4e4071a62b20374028744e8cc8310d48", "status": "affected", "version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "versionType": "git"}, {"lessThan": "fb4d57b83356d4bd411b45ede3024e0ff42c9b5e", "status": "affected", "version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "versionType": "git"}, {"lessThan": "d319b83b97b3585550d9ae592dfa78c755b6129e", "status": "affected", "version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "versionType": "git"}, {"lessThan": "9dbf173bd32d5f81b005008b682bfb50aa093455", "status": "affected", "version": "c694b233295b99c33dd5ac28aede9f171f5a6862", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/crypto/cavium/cpt/cptvf_reqmanager.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: cavium/cpt - fix DMA cleanup using wrong loop index\n\nThe sg_cleanup error path used list[i] instead of list[j] when unmapping\nDMA buffers, leaking successfully mapped entries and repeatedly unmapping\nthe failed one."}], "id": "CVE-2026-74279", "lastModified": "2026-08-17T06:19:21.603", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:27.317", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/23c6174e48f66fc10b998b0acdb406cb0caf5c80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/23d3a7e896a1fe2d7a6bcb42f093948b79f8a198"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/28141f95ae93b18f9bfde953cb787fcb151fb9da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b8a1e1f4e4071a62b20374028744e8cc8310d48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8afd1007ef79898a6e010eaade97097e49405fce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9dbf173bd32d5f81b005008b682bfb50aa093455"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d319b83b97b3585550d9ae592dfa78c755b6129e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb4d57b83356d4bd411b45ede3024e0ff42c9b5e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: crypto: cavium/cpt - fix DMA cleanup using wrong loop index", "id": "2516813", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516813"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncrypto: cavium/cpt - fix DMA cleanup using wrong loop index\nThe sg_cleanup error path used list[i] instead of list[j] when unmapping\nDMA buffers, leaking successfully mapped entries and repeatedly unmapping\nthe failed one.", "A flaw was found in the Linux kernel's `cavium/cpt` cryptographic driver. An incorrect loop index in the `sg_cleanup` error path during Direct Memory Access (DMA) buffer unmapping could lead to resource exhaustion. This issue results in successfully mapped entries being leaked and failed entries being repeatedly unmapped, potentially causing system instability or a denial of service."], "name": "CVE-2026-74279", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74279\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74279\nhttps://lore.kernel.org/linux-cve-announce/2026081545-CVE-2026-74279-aec7@gregkh/T"], "threat_severity": "Moderate"}