CVE-2026-80831: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80831 Overview

CVE-2026-80831 is a Linux kernel vulnerability in the mxs-dcp crypto driver. The mxs_dcp_aes_block_crypt() function calls sg_dma_len() on a source scatterlist without first mapping it with dma_map_sg(). On kernels built with CONFIG_NEED_SG_DMA_LENGTH=y, this returns an invalid or stale DMA length. As a result, AES encryption and decryption operations process the wrong number of bytes. The upstream fix replaces sg_dma_len() with the original scatterlist length, restoring correct cryptographic behavior on affected i.MX platforms.

Critical Impact
Incorrect byte counts in AES operations can produce silent data corruption or truncated ciphertext, undermining data confidentiality and integrity on i.MX devices using the DCP crypto engine.

Affected Products

Linux kernel builds using the mxs-dcp crypto driver (Freescale/NXP i.MX platforms)
Kernel configurations with CONFIG_NEED_SG_DMA_LENGTH=y
Multiple stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80831 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80831

Vulnerability Analysis

The mxs-dcp driver provides hardware-accelerated cryptography on NXP i.MX system-on-chip devices using the Data Co-Processor (DCP). The AES block crypt path in mxs_dcp_aes_block_crypt() iterates over a source scatterlist to feed data into the DCP engine.

The function calls sg_dma_len() to determine how many bytes to submit per segment. sg_dma_len() returns the DMA-mapped length, which is only valid after dma_map_sg() (or an equivalent mapping call) has populated the DMA fields of each scatterlist entry.

Because the driver never performs that mapping on the source scatterlist, the DMA length field is either zero or contains stale data from a prior operation. The engine consequently processes the wrong byte count, leading to incorrect ciphertext or plaintext output.

Root Cause

The root cause is an API contract violation between scatter-gather DMA helpers and the crypto driver. The kernel exposes two distinct length accessors: sg->length returns the logical CPU-side length, while sg_dma_len(sg) returns the length after DMA mapping. When CONFIG_NEED_SG_DMA_LENGTH=y, these are stored in separate fields.

Using sg_dma_len() without a prior dma_map_sg() call reads uninitialized or stale state. The upstream patch resolves this by using the scatterlist's original sg->length field, which is always valid.

Attack Vector

Exploitation requires local access to a system that dispatches AES operations through the mxs-dcp driver. An attacker does not directly trigger memory corruption. Instead, the flaw produces incorrect cryptographic output, which can cascade into integrity failures in higher-level protocols relying on DCP-backed AES. See the upstream kernel commits for the exact code change.

No verified public exploit code is available for this issue. The vulnerability manifests through incorrect data processing rather than a directly weaponizable memory safety violation.

Detection Methods for CVE-2026-80831

Indicators of Compromise

Silent AES ciphertext or plaintext corruption on i.MX devices using DCP acceleration
Application-level integrity check failures (HMAC, AEAD tag mismatches) following crypto operations routed through mxs-dcp
Intermittent decryption failures correlated with specific scatterlist input sizes

Detection Strategies

Inventory kernel builds and identify systems compiled with both the mxs-dcp driver and CONFIG_NEED_SG_DMA_LENGTH=y
Compare running kernel commit hashes against the fix commits published on git.kernel.org for CVE-2026-80831
Run cryptographic self-tests (tcrypt or userspace known-answer tests) on affected hardware to validate AES output correctness

Monitoring Recommendations

Track kernel version and patch status across NXP i.MX fleets using configuration management tooling
Log crypto subsystem errors and correlate with application-layer decryption failures
Subscribe to Linux kernel stable release announcements for backports referencing the mxs-dcp fix

How to Mitigate CVE-2026-80831

Immediate Actions Required

Apply the upstream kernel patch that replaces sg_dma_len() with sg->length in mxs_dcp_aes_block_crypt()
Rebuild and deploy patched kernels to all i.MX devices using the DCP crypto driver
Validate AES output correctness with known-answer tests after patch deployment

Patch Information

The fix is available across multiple stable Linux kernel branches. Reference commits include 04201dc, 0e9edb1, 1537bd5, 182f16a, 6ef9a4a, c5bcb08, da14fae, e72a795, and fd0f211. Consume the fix through your distribution's kernel updates where available.

Workarounds

Disable the mxs-dcp driver and fall back to software AES implementations if patching is not immediately feasible
Route sensitive crypto workloads through userspace libraries (for example, OpenSSL software providers) that do not depend on the DCP engine
Rebuild affected kernels without CONFIG_NEED_SG_DMA_LENGTH=y only where the platform's DMA architecture permits it

bash

# Verify whether the running kernel includes the mxs-dcp driver
zcat /proc/config.gz | grep -E 'CRYPTO_DEV_MXS_DCP|NEED_SG_DMA_LENGTH'

# Temporarily blacklist the driver until a patched kernel is deployed
echo 'blacklist mxs-dcp' | sudo tee /etc/modprobe.d/blacklist-mxs-dcp.conf
sudo update-initramfs -u