---
id: CVE-2026-80831
title: 'crypto: mxs-dcp - fix source scatterlist length access'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: mxs-dcp - fix source scatterlist length access

  mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source
  scatterlist with dma_map_sg() first. Ther…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 <
    fd0f211b27a6ec2ebd8c315683401b43adcc5511
  - >-
    Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 <
    04201dcc88b26eac52f736e39727fc5c420b7257
  - >-
    Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 <
    e72a795df521cb65b7c4705cc11078cdacfaa2f4
  - >-
    Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 <
    1537bd55b4f842565068c54b47cd2ae1777d5f8f
  - >-
    Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 <
    da14fae5203b72ca71ccfa9af8de9249e40d533a
  - >-
    Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 <
    182f16a20d329a1c818d51dad57d9bf43d356c7c
  - >-
    Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 <
    0e9edb108a63bbbef952dfcbc597e34ed9c1fb74
  - >-
    Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 <
    6ef9a4afb52cb102ab038cd42352c142d8505d09
  - >-
    Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 <
    c5bcb084a9871e5b62afb5f48b60adfa13b5d9f8
  - Linux 3.14
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:23.654Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80831'
references:
  - url: 'https://git.kernel.org/stable/c/fd0f211b27a6ec2ebd8c315683401b43adcc5511'
  - url: 'https://git.kernel.org/stable/c/04201dcc88b26eac52f736e39727fc5c420b7257'
  - url: 'https://git.kernel.org/stable/c/e72a795df521cb65b7c4705cc11078cdacfaa2f4'
  - url: 'https://git.kernel.org/stable/c/1537bd55b4f842565068c54b47cd2ae1777d5f8f'
  - url: 'https://git.kernel.org/stable/c/da14fae5203b72ca71ccfa9af8de9249e40d533a'
  - url: 'https://git.kernel.org/stable/c/182f16a20d329a1c818d51dad57d9bf43d356c7c'
  - url: 'https://git.kernel.org/stable/c/0e9edb108a63bbbef952dfcbc597e34ed9c1fb74'
  - url: 'https://git.kernel.org/stable/c/6ef9a4afb52cb102ab038cd42352c142d8505d09'
  - url: 'https://git.kernel.org/stable/c/c5bcb084a9871e5b62afb5f48b60adfa13b5d9f8'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.0534
ingestedAt: '2026-10-19T09:16:01.500Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: mxs-dcp - fix source scatterlist length access

mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source
scatterlist with dma_map_sg() first. Therefore, sg_dma_len() is invalid
and could return zero or a stale DMA length, causing encryption and
decryption to process the wrong number of bytes when
CONFIG_NEED_SG_DMA_LENGTH=y.

Use the original scatterlist length instead.

## Affected

- `Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 < fd0f211b27a6ec2ebd8c315683401b43adcc5511`
- `Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 < 04201dcc88b26eac52f736e39727fc5c420b7257`
- `Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 < e72a795df521cb65b7c4705cc11078cdacfaa2f4`
- `Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 < 1537bd55b4f842565068c54b47cd2ae1777d5f8f`
- `Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 < da14fae5203b72ca71ccfa9af8de9249e40d533a`
- `Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 < 182f16a20d329a1c818d51dad57d9bf43d356c7c`
- `Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 < 0e9edb108a63bbbef952dfcbc597e34ed9c1fb74`
- `Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 < 6ef9a4afb52cb102ab038cd42352c142d8505d09`
- `Linux >= 15b59e7c3733f90ff1f7dd66ad77ae1c90bcdff5 < c5bcb084a9871e5b62afb5f48b60adfa13b5d9f8`
- `Linux 3.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.