CVE-2026-80882: Linux Kernel Crypto Tegra Memory Vulnerability

CVE-2026-80882 Overview

CVE-2026-80882 is a Linux kernel vulnerability in the Tegra cryptographic driver. The flaw resides in the tegra_ccm_do_one_req function, which handles Counter with CBC-MAC (CCM) authenticated encryption requests on NVIDIA Tegra hardware. When the driver fails to allocate an input buffer, it does not set the ENOMEM error value before returning. This missing error propagation causes callers to observe a success status despite the underlying allocation failure, which can lead to processing of uninitialized or invalid buffers.

Critical Impact
Missing error return on allocation failure in the Tegra CCM crypto driver can result in incorrect processing of cryptographic requests and kernel-side memory handling errors.

Affected Products

Linux kernel builds including the crypto: tegra driver on NVIDIA Tegra platforms
Kernel versions prior to the commits referenced in the stable tree fixes
Downstream distributions shipping affected stable kernel branches

Discovery Timeline

2026-09-04 - CVE-2026-80882 published to the National Vulnerability Database
2026-09-04 - Last updated in the NVD database

Technical Details for CVE-2026-80882

Vulnerability Analysis

The defect exists in the Tegra CCM cryptographic transform path. The function tegra_ccm_do_one_req allocates an input buffer used to stage data for hardware-accelerated CCM operations. When that allocation fails, the code path returns without assigning the expected -ENOMEM value to the return variable. The caller therefore receives a stale or zero return value, misinterpreting the failure as a successful buffer setup.

The fix applied across multiple stable branches ensures the return value is explicitly set to -ENOMEM when the allocation fails. This aligns the function with kernel API conventions for reporting memory pressure to upstream callers. See the Linux Kernel Commit 20360e125a and Linux Kernel Commit 690a5f9e5c for the patch details.

Root Cause

The root cause is missing error-code assignment on the allocation-failure branch inside tegra_ccm_do_one_req. Kernel functions must return a negative errno to signal failure. Omitting the ret = -ENOMEM assignment allows an incorrect return value to propagate, breaking the driver's error contract with the crypto subsystem.

Attack Vector

This vulnerability requires local access to a Tegra platform where the CCM crypto driver is active. An unprivileged process that can trigger CCM operations, combined with memory pressure sufficient to fail the input buffer allocation, may reach the flawed code path. The result is undefined behavior in cryptographic request handling rather than a direct remote attack surface. Refer to Linux Kernel Commit 4f3c17f14c and Linux Kernel Commit 5cf0f62419 for the corrective changes.

// No verified exploit code is available for this vulnerability.
// The fix consists of setting ret = -ENOMEM on the allocation-failure
// path within tegra_ccm_do_one_req. See the referenced stable commits
// for the exact source diff.

Detection Methods for CVE-2026-80882

Indicators of Compromise

Unexplained failures or inconsistent results from CCM-mode cryptographic operations on Tegra-based Linux systems
Kernel log entries indicating memory allocation pressure correlated with crypto subsystem errors
Applications relying on kernel CCM acceleration reporting successful operations that produce invalid ciphertext or authentication tags

Detection Strategies

Inventory Linux hosts running on NVIDIA Tegra platforms and confirm which kernel version and stable branch is installed
Compare running kernel commit hashes against the four fix commits referenced in the NVD entry
Review vendor-provided kernel changelogs to confirm inclusion of the tegra_ccm_do_one_req ENOMEM fix

Monitoring Recommendations

Monitor dmesg and journalctl -k output for crypto subsystem warnings on Tegra devices
Track memory pressure metrics on embedded and edge devices where allocation failures are more probable
Alert on unexpected crypto API failures reported by workloads using kernel-accelerated AES-CCM

How to Mitigate CVE-2026-80882

Immediate Actions Required

Apply the stable kernel update that includes the referenced Tegra CCM fix commits
Prioritize patching on NVIDIA Tegra edge, embedded, and automotive Linux deployments
Coordinate with hardware and distribution vendors to obtain patched kernel builds

Patch Information

The Linux kernel maintainers have merged the fix across multiple stable branches. The relevant commits are Linux Kernel Commit 20360e125a, Linux Kernel Commit 4f3c17f14c, Linux Kernel Commit 5cf0f62419, and Linux Kernel Commit 690a5f9e5c. Update to a kernel release that incorporates any of these commits appropriate for your stable branch.

Workarounds

Where patching is delayed, avoid enabling the Tegra CCM crypto driver if hardware-accelerated CCM is not required by workloads
Reduce memory pressure on affected devices to lower the probability of triggering the allocation-failure path
Restrict local unprivileged access on Tegra systems handling sensitive cryptographic workloads

bash

# Verify the running kernel version on a Tegra system
uname -r

# Check whether the fix commits are present in the installed kernel source
git log --oneline | grep -E "20360e125a|4f3c17f14c|5cf0f62419|690a5f9e5c"