Executive brief
A memory allocation error was identified in the Linux kernel's OMAP crypto driver. This component is responsible for hardware-accelerated encryption on certain ARM-based processors. An exploit could allow a local user to cause a system crash or potentially gain unauthorized access to sensitive data by triggering a memory buffer overflow.
Technical details
A memory allocation vulnerability exists in the Linux kernel's OMAP crypto driver (drivers/crypto/omap-crypto.c). The function omap_crypto_copy_sg_lists() incorrectly calculated the size for scatterlist allocations by using the size of a pointer instead of the size of the scatterlist object itself, resulting in an allocation four times smaller than required. This is a classic 'sizeof' mismatch error leading to a heap-based buffer overflow when the undersized buffer is subsequently populated. A local attacker with low privileges can exploit this to cause a kernel panic (DoS) or potentially achieve privilege escalation. The issue has been patched across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.13 to 5.10.251, 5.11 to 5.15.201, 5.16 to 6.1.164, 6.2 to 6.6.125, 6.7 to 6.12.72, 6.13 to 6.18.11, 6.19 to 6.19.1
Timeline
- 2026-02-18: disclosed
- 2026-02-18: advisory
- 2026-02-10: patched: Initial fix committed to mainline kernel.
References
- https://git.kernel.org/stable/c/1562b1fb7e17c1b3addb15e125c718b2be7f5512
- https://git.kernel.org/stable/c/2ed27b5a1174351148c3adbfc0cd86d54072ba2e
- https://git.kernel.org/stable/c/31aff96a41ae6f1f1687c065607875a27c364da8
- https://git.kernel.org/stable/c/6edf8df4bd29f7bfd245b67b2c31d905f1cfc14b
- https://git.kernel.org/stable/c/79f95b51d4278044013672c27519ae88d07013d8
- https://git.kernel.org/stable/c/953c81941b0ad373674656b8767c00234ebf17ac
- https://git.kernel.org/stable/c/c184341920ed78b6466360ed7b45b8922586c38f