CVE-2026-80832

    Dashboard / Vulnerabilities / CVE-2026-80832

    CVE-2026-80832

    Published: 4 Sept 2026Last Modified: 15 Sept 2026

    Summary: crypto: qce - fix CCM AAD buffer underallocation

    Details: In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen() can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as: ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN while the DMA length is set to: ALIGN(assoclen + adata_header_len, 16) Since ALIGN() does not distribute over addition, the allocation can be smaller than the DMA length. For example, when assoclen = 32 and adata_header_len = 2: allocation = ALIGN(32, 16) + 6 = 38 DMA length = ALIGN(32 + 2, 16) = 48 As a result, the QCE hardware can read beyond the allocated buffer while computing the CBC-MAC over the associated data. The extra bytes are folded into the authentication tag, resulting in an incorrect tag and causing CCM self-test failures such as: alg: aead: ccm-aes-qce encryption test failed (wrong result) on test vector 8 Fix the allocation by adding the maximum possible AAD header length before alignment: ALIGN(assoclen + MAX_CCM_ADATA_HEADER_LEN, 16) This guarantees that the allocated buffer is large enough for the fully padded AAD data for all supported header sizes.

    References: https://git.kernel.org/stable/c/002f1f99aef7ea631cb687fc17bce64e4963f6aa, https://git.kernel.org/stable/c/11775b35ce9f27e73d62188d7d38aa0dc0a219aa, https://git.kernel.org/stable/c/2f65718b9c1095eef1ae9b374aa0384b1b083f3c, https://git.kernel.org/stable/c/46a84efe2dbaddde89073a3c00c694486937c34b, https://git.kernel.org/stable/c/4839f4c21f9c577eedef2919ced878a3057c7fc3, https://git.kernel.org/stable/c/7f2345f47dd189625f657cd72437179ab4170ee1, https://git.kernel.org/stable/c/c9e0f06a023107694698a7930616aeb460d91816, https://git.kernel.org/stable/c/cc56d2b0d77cfeea061e98114992ee687d5eb4dd, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80832.json, https://nvd.nist.gov/vuln/detail/CVE-2026-80832, https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9363efb4181c5e0fbf86bdfa759262aa29f0eb50
    Fixed -11775b35ce9f27e73d62188d7d38aa0dc0a219aa

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-80832 | CVE-DB