In the Linux kernel, the following vulnerability has been resolved:
crypto: tegra - fix rctx->cryptlen calculation in tegragcmdoonereq()
Perform rctx->cryptlen calculation in tegragcmdoonereq() the same way it is done in tegraccmcryptinit(). The current formulae may lead to a crash if a caller does not call tegragcmsetauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dstsg buffer.
As a follow-up cleanup delete struct tegraaeadctx->authsize field since it appears to be completely unused. Also simplify tegraccmsetauthsize() and tegragcmsetauthsize() functions respectively.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80522.json"
}