CVE-2026-80945: Linux Kernel IAA Use-After-Free Vulnerability

CVE-2026-80945 Overview

CVE-2026-80945 affects the Linux kernel's Intel Analytics Accelerator (IAA) crypto driver. The flaw resides in the decompression path, where a hardware analytics error triggers a software fallback that writes to req->dst via the CPU while the buffer is still mapped as DMA_FROM_DEVICE. When Software I/O Translation Lookaside Buffer (SWIOTLB) is active, a subsequent dma_unmap_sg() call overwrites the destination with stale bounce buffer contents, corrupting the decompressed output.

Critical Impact
Silent data corruption in cryptographic decompression operations on systems using Intel IAA acceleration with SWIOTLB.

Affected Products

Linux kernel versions containing the IAA crypto driver prior to the referenced fix commits
Systems using Intel In-Memory Analytics Accelerator (IAA) hardware
Deployments where SWIOTLB bounce buffers are active for DMA operations

Discovery Timeline

2026-09-11 - CVE-2026-80945 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-80945

Vulnerability Analysis

The Intel Analytics Accelerator (IAA) crypto driver provides hardware-accelerated compression and decompression. When the hardware reports an analytics error during decompression, the driver falls back to a software implementation to complete the operation. The bug arises because the destination scatter-gather buffer remains mapped for DMA (DMA_FROM_DEVICE) when the software fallback begins writing decompressed data with the CPU.

With SWIOTLB active, the buffer is not the actual destination memory but a bounce buffer allocated by the kernel. The software fallback writes correct data to the destination pages, but the later dma_unmap_sg() call synchronizes the bounce buffer contents back over those pages. The stale hardware-populated bounce buffer overwrites the valid decompressed output, producing corrupted results that callers consume without any error indication.

Root Cause

The root cause is an ordering violation between DMA unmapping and CPU access to the same buffer. The fallback path accesses req->dst before the driver calls dma_unmap_sg(), violating the Linux DMA API contract that prohibits CPU writes to buffers mapped for device access.

Attack Vector

Exploitation does not require code execution or elevated privileges on the affected host. Any workload that submits decompression requests through the kernel crypto API to an IAA device can trigger the fallback path when the hardware returns an analytics error. The resulting silent corruption impacts confidentiality and integrity of processed data streams.

The fix, applied across commits 94a25930, c0279e5e, fc933a4a, and fcd86180, unmaps the destination before the fallback executes. The async path unmaps inline, and the sync path signals the retry with -EAGAIN so iaa_comp_adecompress() invokes the fallback only after unmapping. Refer to the kernel commit fcd86180 for the authoritative patch.

Detection Methods for CVE-2026-80945

Indicators of Compromise

Unexpected data corruption or checksum failures on decompressed payloads produced through the IAA crypto driver
Kernel log entries referencing IAA analytics errors followed by software fallback invocations
Application-level errors from consumers of the kernel crypto compression API on IAA-enabled hosts

Detection Strategies

Audit installed kernel versions against the fix commits 94a25930, c0279e5e, fc933a4a, and fcd86180 to identify vulnerable hosts
Monitor dmesg for iaa_crypto warnings, hardware analytics error codes, and DMA API debug alerts when CONFIG_DMA_API_DEBUG is enabled
Correlate crypto subsystem errors with SWIOTLB usage indicators, particularly on hosts with limited IOMMU coverage

Monitoring Recommendations

Enable kernel telemetry ingestion into a centralized logging platform for continuous review of crypto and DMA subsystem messages
Track hardware error counters exposed by the IAA driver through sysfs to identify hosts triggering the fallback path
Validate output integrity of workloads that rely on kernel-accelerated decompression using end-to-end checksums

How to Mitigate CVE-2026-80945

Immediate Actions Required

Inventory Linux hosts equipped with Intel IAA accelerators and confirm which kernels include the vulnerable driver code
Apply the upstream stable kernel updates that include the four referenced fix commits
Prioritize patching hosts where SWIOTLB is active, since the corruption condition depends on bounce buffer usage

Patch Information

The fix is available in the upstream Linux stable tree through commits 94a25930, c0279e5e, fc933a4a, and fcd86180. Distribution vendors publish backports through their standard kernel update channels; apply them and reboot affected systems.

Workarounds

Disable the IAA crypto driver by unloading the iaa_crypto module where hardware acceleration is not required
Configure the kernel crypto API to prefer software compression implementations until patches are deployed
Ensure sufficient IOMMU coverage or memory sizing to avoid SWIOTLB bounce buffer usage on affected hosts

bash

# Verify IAA crypto module status and unload if unused
lsmod | grep iaa_crypto
sudo modprobe -r iaa_crypto

# Blacklist the driver to prevent reload at boot
echo "blacklist iaa_crypto" | sudo tee /etc/modprobe.d/blacklist-iaa.conf