CVE-2026-97506 is a vulnerability in Linux Kernel
Published on September 24, 2026
crypto: ixp4xx - fix buffer chain unwind on allocation failure
In the Linux kernel, the following vulnerability has been resolved:
crypto: ixp4xx - fix buffer chain unwind on allocation failure
chainup_buffers() builds a linked list of buffer descriptors for a
scatterlist. If dma_pool_alloc() fails while constructing the list, the
current code sets buf to NULL and later dereferences it unconditionally
at the end of the function:
buf->next = NULL;
buf->phys_next = 0;
This can lead to a null-pointer dereference on allocation failure.
If the failure happens after part of the descriptor chain has already
been allocated and DMA-mapped, the partially constructed chain also
needs to be released.
Fix this by terminating the partially constructed chain on allocation
failure and letting the callers unwind it via their existing cleanup
paths. Also fix ablk_perform() to preserve the hook pointers before
checking for failure, so partially built chains can be freed correctly.
Products Associated with CVE-2026-97506
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 04cb00106ca4d0fa9eca24cadc4eda6036e855c8 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 028a7f4f3d69e551f6bf9f728d547bbf4cfc707d is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 25056329384010a8672552b134f609601dc4f80e is affected.
- Before 6.12.111 is affected.
- Before 6.18.53 is affected.
- Version 6.12.111, <= 6.12.* is unaffected.
- Version 6.18.53, <= 6.18.* is unaffected.
- Version 7.2, <= * is unaffected.