{"id":"CVE-2026-80522","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()\n\nPerform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way\nit is done in tegra_…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()\n\nPerform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way\nit is done in tegra_…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < cd6991001bf0681ed0bcf21f9cc3d261d749b2bb","Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < 99a18e1d979e0fad3aaf9c65ae6696897c1d9869","Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < c6237834d9994de209cb90c7a2c461247bce8e90","Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < 360f2974fcea49c61f6d6f81554741a9eeee7168","Linux 6.10"],"published":"2026-08-26","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:57.323","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80522","references":[{"url":"https://git.kernel.org/stable/c/360f2974fcea49c61f6d6f81554741a9eeee7168","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99a18e1d979e0fad3aaf9c65ae6696897c1d9869","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6237834d9994de209cb90c7a2c461247bce8e90","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd6991001bf0681ed0bcf21f9cc3d261d749b2bb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00129,"epssPercentile":0.02491,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:16:31.536900Z"},"ingestedAt":"2026-10-16T19:46:24.320Z","slug":"CVE-2026-80522","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()\n\nPerform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way\nit is done in tegra_ccm_crypt_init(). The current formulae may lead to a\ncrash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize\nremains zero. Then a decrypt operation with incorrect rctx->cryptlen will\nlead to a write beyound rctx->dst_sg buffer.\n\nAs a follow-up cleanup delete struct tegra_aead_ctx->authsize field since\nit appears to be completely unused. Also simplify tegra_ccm_setauthsize()\nand tegra_gcm_setauthsize() functions respectively.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}