{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23222", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.987Z", "datePublished": "2026-02-18T14:53:25.504Z", "dateUpdated": "2026-08-05T12:20:41.276Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:41.276Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly\n\nThe existing allocation of scatterlists in omap_crypto_copy_sg_lists()\nwas allocating an array of scatterlist pointers, not scatterlist objects,\nresulting in a 4x too small allocation.\n\nUse sizeof(*new_sg) to get the correct object size." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The OMAP crypto driver is accessed through the kernel crypto API, reachable by local users via AF_ALG sockets or kernel-internal crypto consumers. No network-facing path directly triggers this driver; physical device access to an OMAP ARM SoC system is not required beyond local login.\nAC:L - A local attacker controls the crypto request input (data size and scatterlist geometry) via AF_ALG, and can craft requests that trigger the BAD_DATA_LENGTH path in omap_crypto_check_sg where scatterlist entry lengths don't match the total, reliably reaching the vulnerable allocation.\nPR:L - AF_ALG sockets are accessible to any unprivileged local user without special capabilities, allowing an ordinary user account to submit crypto requests to the OMAP hardware crypto driver.\nUI:N - No user interaction is needed; the attacker directly submits a crafted crypto request through the AF_ALG socket interface.\nS:U - The vulnerability is in the kernel and impacts the kernel itself; there is no crossing of a security boundary such as a VM or sandbox escape.\nC:H - The heap buffer overflow writes attacker-influenced scatterlist data (page pointers, offsets, lengths from the attacker's scatterlist) past the allocated buffer into adjacent heap objects, which with heap grooming can be leveraged to read arbitrary kernel memory.\nI:H - The heap overflow corrupts adjacent kernel heap objects with attacker-influenced data; through heap spraying and grooming, this can overwrite function pointers or other security-sensitive structures, enabling arbitrary code execution.\nA:H - Writing beyond the allocated buffer corrupts adjacent heap metadata and objects, causing kernel crashes (oops/panic) when the corrupted data is subsequently accessed." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/omap-crypto.c" ], "versions": [ { "version": "74ed87e7e7f7197137164738dd0610ccd5ec5ed1", "lessThan": "953c81941b0ad373674656b8767c00234ebf17ac", "status": "affected", "versionType": "git" }, { "version": "74ed87e7e7f7197137164738dd0610ccd5ec5ed1", "lessThan": "31aff96a41ae6f1f1687c065607875a27c364da8", "status": "affected", "versionType": "git" }, { "version": "74ed87e7e7f7197137164738dd0610ccd5ec5ed1", "lessThan": "79f95b51d4278044013672c27519ae88d07013d8", "status": "affected", "versionType": "git" }, { "version": "74ed87e7e7f7197137164738dd0610ccd5ec5ed1", "lessThan": "6edf8df4bd29f7bfd245b67b2c31d905f1cfc14b", "status": "affected", "versionType": "git" }, { "version": "74ed87e7e7f7197137164738dd0610ccd5ec5ed1", "lessThan": "c184341920ed78b6466360ed7b45b8922586c38f", "status": "affected", "versionType": "git" }, { "version": "74ed87e7e7f7197137164738dd0610ccd5ec5ed1", "lessThan": "2ed27b5a1174351148c3adbfc0cd86d54072ba2e", "status": "affected", "versionType": "git" }, { "version": "74ed87e7e7f7197137164738dd0610ccd5ec5ed1", "lessThan": "d1836c628cb72734eb5f7dfd4c996a9c18bba3ad", "status": "affected", "versionType": "git" }, { "version": "74ed87e7e7f7197137164738dd0610ccd5ec5ed1", "lessThan": "1562b1fb7e17c1b3addb15e125c718b2be7f5512", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/omap-crypto.c" ], "versions": [ { "version": "4.13", "status": "affected" }, { "version": "0", "lessThan": "4.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.251", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.201", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.164", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.125", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.72", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.11", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.1", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.10.251" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.15.201" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.1.164" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.6.125" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.12.72" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.18.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.19.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/953c81941b0ad373674656b8767c00234ebf17ac" }, { "url": "https://git.kernel.org/stable/c/31aff96a41ae6f1f1687c065607875a27c364da8" }, { "url": "https://git.kernel.org/stable/c/79f95b51d4278044013672c27519ae88d07013d8" }, { "url": "https://git.kernel.org/stable/c/6edf8df4bd29f7bfd245b67b2c31d905f1cfc14b" }, { "url": "https://git.kernel.org/stable/c/c184341920ed78b6466360ed7b45b8922586c38f" }, { "url": "https://git.kernel.org/stable/c/2ed27b5a1174351148c3adbfc0cd86d54072ba2e" }, { "url": "https://git.kernel.org/stable/c/d1836c628cb72734eb5f7dfd4c996a9c18bba3ad" }, { "url": "https://git.kernel.org/stable/c/1562b1fb7e17c1b3addb15e125c718b2be7f5512" } ], "title": "crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:01:02.214Z" }, "affected": [ { "vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [ { "status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" } ] } ] } }