Executive brief
The Linux kernel's Tegra cryptographic driver contains a logic error in its error-handling path that could fail to properly propagate memory allocation failures to applications. When the driver cannot allocate memory for intermediate buffers during cryptographic operations, it does not correctly set an error code, potentially leading to incomplete error handling and undefined behavior.
Technical details
The vulnerability is a missing error return code assignment in the tegra_ccm_do_one_req function within the Tegra AES cryptographic driver (drivers/crypto/tegra/tegra-se-aes.c). When DMA-coherent memory allocation for the input buffer fails, the code skips the assignment of the ENOMEM error code before jumping to an error cleanup path. This allows the function to proceed to the output buffer allocation attempt without proper error state, or exit with an incorrect/uninitialized return value. The fix explicitly sets ret = -ENOMEM before the first allocation check. This is a code path correctness issue rather than an exploitable security flaw, affecting error handling reliability on systems using Tegra hardware with AES-CCM operations.
Affected products
- Linux Linux kernel linux 2.6.11 through linux 7.2.y and rolling branches
Timeline
- 2026-09-04: disclosed
- 2026-05-20: patched