Skip to content
Heist/ feed
Back to feed
UnratedFix available

crypto: ixp4xx - fix buffer chain unwind on allocation failure

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: crypto: ixp4xx - fix buffer chain unwind on allocation failure chainup_buffers() builds a linked list of buffer descriptors for a scatterlist. If dma_pool_alloc() fails while constructing the list, the current code sets buf to NULL and later dereferences it unconditionally at the end of the function: buf->next = NULL; buf->phys_next = 0; This can lead to a null-pointer dereference on allocation failure. If the failure happens after part of the descriptor chain has already been allocated and DMA-mapped, the partially constructed chain also needs to be released. Fix this by terminating the partially constructed chain on allocation failure and letting the callers unwind it via their existing cleanup paths. Also fix ablk_perform() to preserve the hook pointers before checking for failure, so partially built chains can be freed correctly.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.15.222, 6.1.189, 6.12.111, 6.18.53, 6.6.158
CVEs
CVE-2026-97506
Confirmed fixed CVEs
Not specified
Updated in this feed
28 Oct 2026, 08:58 UTC · Revision 1

Source evidence

crypto: ixp4xx - fix buffer chain unwind on allocation failure

core-osv · Original source

Published 24 Sept 2026, 16:04 UTC

In the Linux kernel, the following vulnerability has been resolved: crypto: ixp4xx - fix buffer chain unwind on allocation failure chainup_buffers() builds a linked list of buffer descriptors for a scatterlist. If dma_pool_alloc() fails while constructing the list, the current code sets buf to NULL and later dereferences it unconditionally at the end of the function: buf->next = NULL; buf->phys_next = 0; This can lead to a null-pointer dereference on allocation failure. If the failure happens after part of the descriptor chain has already been allocated and DMA-mapped, the partially constructed chain also needs to be released. Fix this by terminating the partially constructed chain on allocation failure and letting the callers unwind it via their existing cleanup paths. Also fix ablk_perform() to preserve the hook pointers before checking for failure, so partially built chains can be freed correctly.

osv:CVE-2026-97506

Kernel

Fixed versions: 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53

Complete source record
{
  "id": "56dcde4d4e357fa24faee7a6c70db5e0925bb2f56967d8202c9f90befdf7cd79",
  "url": "https://osv.dev/vulnerability/CVE-2026-97506",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "crypto: ixp4xx - fix buffer chain unwind on allocation failure",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: crypto: ixp4xx - fix buffer chain unwind on allocation failure chainup_buffers() builds a linked list of buffer descriptors for a scatterlist. If dma_pool_alloc() fails while constructing the list, the current code sets buf to NULL and later dereferences it unconditionally at the end of the function: buf->next = NULL; buf->phys_next = 0; This can lead to a null-pointer dereference on allocation failure. If the failure happens after part of the descriptor chain has already been allocated and DMA-mapped, the partially constructed chain also needs to be released. Fix this by terminating the partially constructed chain on allocation failure and letting the callers unwind it via their existing cleanup paths. Also fix ablk_perform() to preserve the hook pointers before checking for failure, so partially built chains can be freed correctly.",
    "evidence": "osv:CVE-2026-97506",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.15.222",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.189",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.158",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.111",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.53",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-97506",
      "aliases": [
        "CVE-2026-97506"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0d44dc59b2b434b29aafeae581d06f81efac7c83"
                },
                {
                  "fixed": "d4007867be42d71795b78fa7f8ce7514dda9ca83"
                },
                {
                  "fixed": "4918b0bd7d2baafb45d87dca9e322137c96005c2"
                },
                {
                  "fixed": "8c37bc8d6a6f77bf9593fb1bcab6c14c7cf02991"
                },
                {
                  "fixed": "04cb00106ca4d0fa9eca24cadc4eda6036e855c8"
                },
                {
                  "fixed": "028a7f4f3d69e551f6bf9f728d547bbf4cfc707d"
                },
                {
                  "fixed": "25056329384010a8672552b134f609601dc4f80e"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "2.6.27.22"
                },
                {
                  "fixed": "2.6.28"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "2.6.28.10"
                },
                {
                  "fixed": "2.6.29"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "2.6.29.3"
                },
                {
                  "fixed": "2.6.30"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5a80273150a8a1725fa70418d106eb1f2ee8fd2f"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "82a8becb9c2c52fc5e67057a43aeded1f0731e7b"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "68845515c8b11791b547a2838e22c27dfa3115ee"
                }
              ]
            }
          ],
          "versions": [
            "v2.6.27.62",
            "v2.6.27.61",
            "v2.6.27.60",
            "v2.6.27.59",
            "v2.6.27.58",
            "v2.6.27.57",
            "v2.6.27.56",
            "v2.6.27.55",
            "v2.6.27.54",
            "v2.6.27.53",
            "v2.6.27.52",
            "v2.6.27.51",
            "v2.6.27.50",
            "v2.6.27.49",
            "v2.6.27.48",
            "v2.6.27.47",
            "v2.6.27.46",
            "v2.6.27.45",
            "v2.6.27.44",
            "v2.6.27.43",
            "v2.6.27.42",
            "v2.6.27.41",
            "v2.6.27.40",
            "v2.6.27.39",
            "v2.6.27.38",
            "v2.6.27.37",
            "v2.6.27.36",
            "v2.6.27.35",
            "v2.6.27.34",
            "v2.6.27.33",
            "v2.6.27.32",
            "v2.6.27.31",
            "v2.6.27.30",
            "v2.6.27.29",
            "v2.6.27.28",
            "v2.6.27.27",
            "v2.6.27.26",
            "v2.6.27.25",
            "v2.6.27.24",
            "v2.6.27.23",
            "v2.6.27.22",
            "v2.6.28.10",
            "v2.6.29.6",
            "v2.6.29.5",
            "v2.6.29.4",
            "v2.6.29.3"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97506.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "2.6.30"
                },
                {
                  "fixed": "5.15.222"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.189"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.158"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.111"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.53"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97506.json"
          }
        }
      ],
      "modified": "2026-10-08T02:52:42.591133291Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/028a7f4f3d69e551f6bf9f728d547bbf4cfc707d",
        "https://git.kernel.org/stable/c/04cb00106ca4d0fa9eca24cadc4eda6036e855c8",
        "https://git.kernel.org/stable/c/25056329384010a8672552b134f609601dc4f80e",
        "https://git.kernel.org/stable/c/4918b0bd7d2baafb45d87dca9e322137c96005c2",
        "https://git.kernel.org/stable/c/8c37bc8d6a6f77bf9593fb1bcab6c14c7cf02991",
        "https://git.kernel.org/stable/c/d4007867be42d71795b78fa7f8ce7514dda9ca83",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97506.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-97506",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97506.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-97506",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 98374,
  "published_at": "2026-09-24T16:04:55.504+00:00"
}