Executive brief
The Linux kernel's MXS DCP (Data Co-Processor) driver used an invalid DMA length value when processing encryption and decryption operations. This caused the cryptographic operations to process an incorrect number of bytes, potentially leading to incomplete or corrupted encryption/decryption of data. Systems running kernels with this bug would experience incorrect cryptographic results when using the affected driver.
Technical details
The vulnerability exists in the mxs_dcp_aes_block_crypt() function, which incorrectly calls sg_dma_len() on a source scatterlist that was never mapped with dma_map_sg(). This causes sg_dma_len() to return zero or a stale DMA length value when CONFIG_NEED_SG_DMA_LENGTH=y, resulting in incorrect byte counts being processed during encryption and decryption operations. The fix replaces the invalid sg_dma_len() call with the original scatterlist length (src->length). This is a local, non-exploitable logic bug that affects cryptographic correctness rather than security boundaries, and a patch is available in upstream kernel commits.
Affected products
- Linux Linux kernel multiple versions with mxs-dcp driver
Timeline
- 2026-09-04: disclosed: Published to NVD
- 2026-06-21: patched: Fix committed upstream by Thorsten Blum
- 2026-09-02: patched: Fix integrated into stable kernel releases