CVE-2026-80836

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crypto: virtio - bound the akcipher result length

virtio_crypto_dataq_akcipher_callback() sets the result length from the

device-reported response length without bounding it to the destination

buffer, which was allocated for the original request length.

sg_copy_from_buffer() then reads that many bytes from the destination

buffer; a backend reporting a larger length over-reads adjacent kernel

heap into the caller's scatterlist (an out-of-bounds read).

Clamp the reported length to the originally requested destination length.

A conforming device reports no more than that, so valid results are

unaffected.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References