Executive brief
The Linux kernel's Marvell OcteonTX cryptographic accelerator driver contains a bug in its DMA cleanup code that uses the wrong loop variable when freeing mapped memory buffers. This causes already-freed buffers to be unmapped repeatedly while some allocated buffers are never freed, leading to memory corruption and potential system instability or denial of service.
Technical details
The vulnerability exists in the sg_cleanup code path of drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c, where a loop uses index variable i instead of j when calling dma_unmap_single(). The loop iterates over successfully mapped DMA buffers using j (0 to i-1), but attempts to unmap list[i] repeatedly, causing double-free errors. Successfully mapped entries at indices 0 through i-1 are never unmapped, leaking their DMA mappings. This is triggered during scatter-gather I/O cleanup in cryptographic request handling, which runs with kernel privileges. An attacker with ability to trigger failed DMA mapping operations can exploit this to cause memory corruption and system crash. The fix changes list[i] to list[j] in the dma_unmap_single() call.
Affected products
- Linux Linux kernel multiple kernel versions (introduced in commit 10b4f09491bf, affecting 4.x through 7.x series)
Timeline
- 2026-08-15: disclosed
- 2026-06-02: patched: Fix committed upstream; backported to stable kernel trees