{"id":"CVE-2026-80832","revision":"65840547b6c14915b934b2d28404ee04","records":[{"revision":"65840547b6c14915b934b2d28404ee04","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80832","aliases":[],"title":"crypto: qce - fix CCM AAD buffer underallocation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qce - fix CCM AAD buffer underallocation\n\nThe AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen()\ncan be smaller than the length later programmed into the DMA\nscatterlist.\n\nThe allocation size is currently calculated as:\n\n  ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN\n\nwhile the DMA length is set to:\n\n  ALIGN(assoclen + adata_header_len, 16)\n\nSince ALIGN() does not distribute over addition, the allocation\ncan be smaller than the DMA length. For example, when\nassoclen = 32 and adata_header_len = 2:\n\n  allocation = ALIGN(32, 16) + 6 = 38\n  DMA length = ALIGN(32 + 2, 16) = 48\n\nAs a result, the QCE hardware can read beyond the allocated\nbuffer while computing the CBC-MAC over the associated data.\nThe extra bytes are folded into the authentication tag,\nresulting in an incorrect tag and causing CCM self-test\nfailures such as:\n\n  alg: aead: ccm-aes-qce encryption test failed (wrong result)\n  on test vector 8\n\nFix the allocation by adding the maximum possible AAD header\nlength before alignment:\n\n  ALIGN(assoclen + MAX_CCM_ADATA_HEADER_LEN, 16)\n\nThis guarantees that the allocated buffer is large enough\nfor the fully padded AAD data for all supported header sizes.","state":0,"publishedAt":"2026-09-04T15:54:40.017+00:00","modifiedAt":"2026-10-19T08:44:24.636+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/crypto/qce/aead.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"9363efb4181c5e0fbf86bdfa759262aa29f0eb50\",\n                            \"lessThan\": \"11775b35ce9f27e73d62188d7d38aa0dc0a219aa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9363efb4181c5e0fbf86bdfa759262aa29f0eb50\",\n                            \"lessThan\": \"c9e0f06a023107694698a7930616aeb460d91816\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9363efb4181c5e0fbf86bdfa759262aa29f0eb50\",\n                            \"lessThan\": \"cc56d2b0d77cfeea061e98114992ee687d5eb4dd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9363efb4181c5e0fbf86bdfa759262aa29f0eb50\",\n                            \"lessThan\": \"002f1f99aef7ea631cb687fc17bce64e4963f6aa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9363efb4181c5e0fbf86bdfa759262aa29f0eb50\",\n                            \"lessThan\": \"2f65718b9c1095eef1ae9b374aa0384b1b083f3c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9363efb4181c5e0fbf86bdfa759262aa29f0eb50\",\n                            \"lessThan\": \"46a84efe2dbaddde89073a3c00c694486937c34b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9363efb4181c5e0fbf86bdfa759262aa29f0eb50\",\n                            \"lessThan\": \"4839f4c21f9c577eedef2919ced878a3057c7fc3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9363efb4181c5e0fbf86bdfa759262aa29f0eb50\",\n                            \"lessThan\": \"7f2345f47dd189625f657cd72437179ab4170ee1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/crypto/qce/aead.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.220\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.187\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.156\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.108\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.49\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.13\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.3\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/11775b35ce9f27e73d62188d7d38aa0dc0a219aa","https://git.kernel.org/stable/c/c9e0f06a023107694698a7930616aeb460d91816","https://git.kernel.org/stable/c/cc56d2b0d77cfeea061e98114992ee687d5eb4dd","https://git.kernel.org/stable/c/002f1f99aef7ea631cb687fc17bce64e4963f6aa","https://git.kernel.org/stable/c/2f65718b9c1095eef1ae9b374aa0384b1b083f3c","https://git.kernel.org/stable/c/46a84efe2dbaddde89073a3c00c694486937c34b","https://git.kernel.org/stable/c/4839f4c21f9c577eedef2919ced878a3057c7fc3","https://git.kernel.org/stable/c/7f2345f47dd189625f657cd72437179ab4170ee1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80832","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80832","identifiers":["CVE-2026-80832"]},"retained":false,"historicalAffected":[]}],"coverage":[]}