https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:12:27 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80836 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: virtio - bound the akcipher result length</p> <p>virtio_crypto_dataq_akcipher_callback() sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the original request length. sg_copy_from_buffer() then reads that many bytes from the destination buffer; a backend reporting a larger length over-reads adjacent kernel heap into the caller&#39;s scatterlist (an out-of-bounds read).</p> <p>Clamp the reported length to the originally requested destination length. A conforming device reports no more than that, so valid results are unaffected.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: virtio - bound the akcipher result length</p> <p>virtio_crypto_dataq_akcipher_callback() sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the original request length. sg_copy_from_buffer() then reads that many bytes from the destination buffer; a backend reporting a larger length over-reads adjacent kernel heap into the caller&#39;s scatterlist (an out-of-bounds read).</p> <p>Clamp the reported length to the originally requested destination length. A conforming device reports no more than that, so valid results are unaffected.</p> https://vulnerability.circl.lu/vuln/cve-2026-80836