CVE-2026-74279 (GCVE-0-2026-74279)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-10-16 18:55
VLAI
EPSS
VEX
Title
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
The sg_cleanup error path used list[i] instead of list[j] when unmapping
DMA buffers, leaking successfully mapped entries and repeatedly unmapping
the failed one.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:51 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
c694b233295b99c33dd5ac28aede9f171f5a6862 , < 23c6174e48f66fc10b998b0acdb406cb0caf5c80
(git)
Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 23d3a7e896a1fe2d7a6bcb42f093948b79f8a198 (git) Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 28141f95ae93b18f9bfde953cb787fcb151fb9da (git) Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 8afd1007ef79898a6e010eaade97097e49405fce (git) Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 3b8a1e1f4e4071a62b20374028744e8cc8310d48 (git) Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < fb4d57b83356d4bd411b45ede3024e0ff42c9b5e (git) Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < d319b83b97b3585550d9ae592dfa78c755b6129e (git) Affected: c694b233295b99c33dd5ac28aede9f171f5a6862 , < 9dbf173bd32d5f81b005008b682bfb50aa093455 (git) |
guessed | |
| Linux | Linux |
Affected:
4.11
Unaffected: 0 , < 4.11 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74279",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:59.460893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:29.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "23c6174e48f66fc10b998b0acdb406cb0caf5c80",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "23d3a7e896a1fe2d7a6bcb42f093948b79f8a198",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "28141f95ae93b18f9bfde953cb787fcb151fb9da",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "8afd1007ef79898a6e010eaade97097e49405fce",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "3b8a1e1f4e4071a62b20374028744e8cc8310d48",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "fb4d57b83356d4bd411b45ede3024e0ff42c9b5e",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "d319b83b97b3585550d9ae592dfa78c755b6129e",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "9dbf173bd32d5f81b005008b682bfb50aa093455",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: cavium/cpt - fix DMA cleanup using wrong loop index\n\nThe sg_cleanup error path used list[i] instead of list[j] when unmapping\nDMA buffers, leaking successfully mapped entries and repeatedly unmapping\nthe failed one."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On Cavium Thunder appliances the CPT VF skcipher driver is selected for in-kernel crypto on network-facing workloads (IPsec/xfrm ESP decrypt, NFS/RPC GSS-Kerberos), so remote peers can drive setup_sgio_components() by sending traffic that triggers hardware-accelerated AES/DES operations.\nAC:L - An attacker can reliably force the error path by fragmenting crypto buffers to raise incnt/outcnt and flooding concurrent encrypt/decrypt requests to exhaust IOMMU IOVAs, causing dma_map_single() to fail mid-loop; no uncontrollable victim state or race is required.\nPR:N - Exploitation requires no root or capabilities on the victim host; remote network peers sending IPsec or authenticated RPC traffic, or any local process using the kernel crypto API via AF_ALG sockets, can trigger the faulty DMA cleanup without admin privileges.\nUI:N - Exploitation is fully attacker-driven through automated network traffic or programmatic crypto requests and does not require any victim user action such as opening files or mounting filesystems.\nS:C - Leaked DMA mappings let the CPT PCI function continue bus-mastering kernel pages after software teardown, bypassing intended kernel DMA lifecycle and IOMMU-enforced device isolation boundaries when stale mappings target freed or repurposed memory.\nC:H - Unmapping failures leave active DMA translations while dma_addr metadata is cleared, allowing the CPT hardware to read kernel memory from freed or reallocated pages, providing a memory-corruption primitive that can disclose sensitive data.\nI:H - Stale bidirectional DMA mappings combined with bogus unmaps on DMA_MAPPING_ERROR can corrupt IOMMU state and let the accelerator write into kernel pages no longer owned by the request, enabling control of kernel memory contents.\nA:H - Repeated dma_unmap_single() on DMA_MAPPING_ERROR triggers WARN_ON in iommu_dma_unmap_phys, and accumulating leaked IOMMU mappings can exhaust DMA resources or panic the kernel during subsequent crypto operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:20.085Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/23c6174e48f66fc10b998b0acdb406cb0caf5c80"
},
{
"url": "https://git.kernel.org/stable/c/23d3a7e896a1fe2d7a6bcb42f093948b79f8a198"
},
{
"url": "https://git.kernel.org/stable/c/28141f95ae93b18f9bfde953cb787fcb151fb9da"
},
{
"url": "https://git.kernel.org/stable/c/8afd1007ef79898a6e010eaade97097e49405fce"
},
{
"url": "https://git.kernel.org/stable/c/3b8a1e1f4e4071a62b20374028744e8cc8310d48"
},
{
"url": "https://git.kernel.org/stable/c/fb4d57b83356d4bd411b45ede3024e0ff42c9b5e"
},
{
"url": "https://git.kernel.org/stable/c/d319b83b97b3585550d9ae592dfa78c755b6129e"
},
{
"url": "https://git.kernel.org/stable/c/9dbf173bd32d5f81b005008b682bfb50aa093455"
}
],
"title": "crypto: cavium/cpt - fix DMA cleanup using wrong loop index",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74279",
"datePublished": "2026-08-15T05:57:50.131Z",
"dateReserved": "2026-08-15T05:44:03.880Z",
"dateUpdated": "2026-10-16T18:55:29.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74279",
"date": "2026-11-01",
"epss": "0.00755",
"percentile": "0.55134"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "23c6174e48f66fc10b998b0acdb406cb0caf5c80",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "23d3a7e896a1fe2d7a6bcb42f093948b79f8a198",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "28141f95ae93b18f9bfde953cb787fcb151fb9da",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "8afd1007ef79898a6e010eaade97097e49405fce",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "3b8a1e1f4e4071a62b20374028744e8cc8310d48",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "fb4d57b83356d4bd411b45ede3024e0ff42c9b5e",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "d319b83b97b3585550d9ae592dfa78c755b6129e",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "9dbf173bd32d5f81b005008b682bfb50aa093455",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: cavium/cpt - fix DMA cleanup using wrong loop index\n\nThe sg_cleanup error path used list[i] instead of list[j] when unmapping\nDMA buffers, leaking successfully mapped entries and repeatedly unmapping\nthe failed one."
}
],
"id": "CVE-2026-74279",
"lastModified": "2026-10-16T19:17:35.863",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74279",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:59.460893Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-15T06:22:27.317",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/23c6174e48f66fc10b998b0acdb406cb0caf5c80"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/23d3a7e896a1fe2d7a6bcb42f093948b79f8a198"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/28141f95ae93b18f9bfde953cb787fcb151fb9da"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3b8a1e1f4e4071a62b20374028744e8cc8310d48"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/8afd1007ef79898a6e010eaade97097e49405fce"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9dbf173bd32d5f81b005008b682bfb50aa093455"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d319b83b97b3585550d9ae592dfa78c755b6129e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/fb4d57b83356d4bd411b45ede3024e0ff42c9b5e"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-20T15:18:55+00:00",
"cve": "CVE-2026-74279",
"id": "CVE-2026-74279",
"initial_release_date": "2026-08-15T00:00:00+00:00",
"product_status:known_not_affected": "274",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: crypto: cavium/cpt - fix DMA cleanup using wrong loop index",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74279.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.