Executive brief
The Linux kernel's sa2ul cryptographic hardware acceleration driver failed to properly handle DMA memory pool creation failures during device initialization. When memory pool setup failed, the driver continued probe operations anyway, leading to a system state where subsequent cryptographic operations would fail or crash. The patch ensures the driver correctly stops initialization and cleans up resources when pool creation fails.
Technical details
The vulnerability is a missing error check in the sa_ul_probe() function of the sa2ul crypto driver (drivers/crypto/sa2ul.c). The function calls sa_init_mem() to allocate a DMA pool for security context buffers but ignored its return value. If pool creation failed, probe would continue with DMA setup, algorithm registration, and child device population despite later request handling depending on the pool's existence. This is a resource initialization error check deficiency. The fix captures sa_init_mem()'s return value and bails out to the proper cleanup path (disable_pm label) if initialization fails, preventing state inconsistency. No special preconditions or network access required; the bug manifests during driver probe on affected platforms (likely TI KeyStone or similar sa2ul-supporting SoCs).
Affected products
- Linux Linux kernel all versions prior to upstream fix (commit d03f980a25853f6a380895119a572a3bb1194e8d and backports)
Timeline
- 2026-09-17: disclosed: CVE-2026-93158 published
- 2026-06-16: patched: Upstream commit d03f980a25853f6a380895119a572a3bb1194e8d authored
- 2026-09-14: patched: Backports merged to stable kernel trees