CVE-2026-97506

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crypto: ixp4xx - fix buffer chain unwind on allocation failure

chainup_buffers() builds a linked list of buffer descriptors for a

scatterlist. If dma_pool_alloc() fails while constructing the list, the

current code sets buf to NULL and later dereferences it unconditionally

at the end of the function:

buf->next = NULL;

buf->phys_next = 0;

This can lead to a null-pointer dereference on allocation failure.

If the failure happens after part of the descriptor chain has already

been allocated and DMA-mapped, the partially constructed chain also

needs to be released.

Fix this by terminating the partially constructed chain on allocation

failure and letting the callers unwind it via their existing cleanup

paths. Also fix ablk_perform() to preserve the hook pointers before

checking for failure, so partially built chains can be freed correctly.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References