Executive brief
A bug in the Linux kernel's Cavium cryptographic accelerator driver causes incorrect cleanup of DMA-mapped memory buffers when an error occurs during setup. The faulty code repeatedly attempts to unmap the wrong buffer entry, potentially causing memory corruption or system instability while leaving other buffers unmapped and leaking memory.
Technical details
An off-by-one error in the sg_cleanup error path of the Cavium CPT virtual function driver uses the wrong loop index (list[i] instead of list[j]) when unmapping DMA buffers. This causes successfully mapped entries to remain mapped (leak) while the failed entry is unmapped repeatedly. The vulnerable code is in drivers/crypto/cavium/cpt/cptvf_reqmanager.c in the setup_sgio_components() function. Exploitation requires local kernel code execution to trigger the error path during DMA buffer setup. The fix corrects the index reference in two dma_unmap_single() calls to use the correct loop variable. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel affected versions with Cavium CPT driver (approximately 4.19 and later)
Timeline
- 2026-08-15: disclosed
- 2026-06-02: patched