From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F7F0380FF4 for ; Sat, 15 Aug 2026 06:32:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775571; cv=none; b=OzkJgUhJjzYgwQCPo9jUm/oT60jV+XJW2DH4DxFvtqdejUxOmVWk8zZToRuqOfkUL7RizxeoM/6yuJZG//U65xCc/drABsivT/jcM9iWhPif9IN1z+ksG3bGmspjZoquwBKS03xYDraUrmrqTo2Cz1IzFdZF8EcMvGA1QklgmSU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775571; c=relaxed/simple; bh=s4nBGQe4NAaBE5pQmiypAX3AzQgs+KUZiHQBiAwBbWM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FdAj/6gpIttg5A0eLoCpAxeZQb97osVlpZ+RGjyiELs99gdNnG33gxOKqgSlF9t+WITBwVo3Cgwx1mB/Wmq9Om7Xtworo8PMYO+DO33Sy1/vFunshvvG3+p/hxKvtdsE6diHi81iCukx4eYZUE84hUhtU2rJAOlsAyXD73KJLgw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ttxxaqJQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ttxxaqJQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B68A51F000E9; Sat, 15 Aug 2026 06:32:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775570; bh=I4LMao3UO32hfrHrkcfvEKgpcDg2W8G5zjsg7VUX7e4=; h=From:To:Cc:Subject:Date:Reply-To; b=ttxxaqJQPZACDkzIRVhJp8fk3Y+Twsy6c73B9wcUsQV34GWs3EZp0AtI2JeiKPQAB l65cvfBesHMY8oF2ATxww2JAwzJk7ysTOrXw8UTJsn3JINIJnurYAdVudS7J4IMjGK 507ZZ8i2C3pBSfD3EqMIkwg7+h2ej9YSl7VrEpow= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74280: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index Date: Sat, 15 Aug 2026 15:10:07 +0900 Message-ID: <2026081546-CVE-2026-74280-623d@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3327; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=5LiJZQ9XzM6CfFkn++ooLbD0DFImvBO++7EhGMvYqrs=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNjGzWAuk/eZRLn4u8En5QUZxn93j2a62+bc7t19g6U 1d/eLyzI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACZyvYRhwQbvFgFlyx0nxZZX XCp02Pz77Eyd8wzzM+6vOVS4XODn9GvCmZNaXxbtuDpfFwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sg_cleanup path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one. The Linux kernel CVE team has assigned CVE-2026-74280 to this issue. Affected and fixed versions =========================== Issue introduced in 5.7 with commit 10b4f09491bfeb0b298cb2f49df585510ee6189a and fixed in 5.10.261 with commit 97f150ba3e372256eabb93bd80c2cf3740077fb5 Issue introduced in 5.7 with commit 10b4f09491bfeb0b298cb2f49df585510ee6189a and fixed in 5.15.212 with commit 8a0db9fad3c97e6447a92417cb95d7c55eaa9530 Issue introduced in 5.7 with commit 10b4f09491bfeb0b298cb2f49df585510ee6189a and fixed in 6.1.178 with commit 8d301e5a51173ba56ce4f632a2a33bf6b14b0fcf Issue introduced in 5.7 with commit 10b4f09491bfeb0b298cb2f49df585510ee6189a and fixed in 6.6.145 with commit ed374dbc70c10c4a864414b3d9c257faec8fd485 Issue introduced in 5.7 with commit 10b4f09491bfeb0b298cb2f49df585510ee6189a and fixed in 6.12.97 with commit 6c721a3e43344f8560ee4ef506fc1f72b4646dcd Issue introduced in 5.7 with commit 10b4f09491bfeb0b298cb2f49df585510ee6189a and fixed in 6.18.40 with commit 5f99a396f706afc749448659d1565991330e4f71 Issue introduced in 5.7 with commit 10b4f09491bfeb0b298cb2f49df585510ee6189a and fixed in 7.1.5 with commit acff30cfc0d72465b51b0bfdf019f1cb54e15314 Issue introduced in 5.7 with commit 10b4f09491bfeb0b298cb2f49df585510ee6189a and fixed in 7.2-rc1 with commit 7891c64c0520519782470ba29bac8a5761e295d8 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74280 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/97f150ba3e372256eabb93bd80c2cf3740077fb5 https://git.kernel.org/stable/c/8a0db9fad3c97e6447a92417cb95d7c55eaa9530 https://git.kernel.org/stable/c/8d301e5a51173ba56ce4f632a2a33bf6b14b0fcf https://git.kernel.org/stable/c/ed374dbc70c10c4a864414b3d9c257faec8fd485 https://git.kernel.org/stable/c/6c721a3e43344f8560ee4ef506fc1f72b4646dcd https://git.kernel.org/stable/c/5f99a396f706afc749448659d1565991330e4f71 https://git.kernel.org/stable/c/acff30cfc0d72465b51b0bfdf019f1cb54e15314 https://git.kernel.org/stable/c/7891c64c0520519782470ba29bac8a5761e295d8