---
id: CVE-2026-97506
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: ixp4xx - fix buffer chain unwind on allocation failure

  chainup_buffers() builds a linked list of buffer descriptors for a
  scatterlist
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: ixp4xx - fix buffer chain unwind on allocation failure

  chainup_buffers() builds a linked list of buffer descriptors for a
  scatterlist. If dma_pool_alloc() fail…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0d44dc59b2b434b29aafeae581d06f81efac7c83 <
    d4007867be42d71795b78fa7f8ce7514dda9ca83
  - >-
    Linux >= 0d44dc59b2b434b29aafeae581d06f81efac7c83 <
    4918b0bd7d2baafb45d87dca9e322137c96005c2
  - >-
    Linux >= 0d44dc59b2b434b29aafeae581d06f81efac7c83 <
    8c37bc8d6a6f77bf9593fb1bcab6c14c7cf02991
  - >-
    Linux >= 0d44dc59b2b434b29aafeae581d06f81efac7c83 <
    04cb00106ca4d0fa9eca24cadc4eda6036e855c8
  - >-
    Linux >= 0d44dc59b2b434b29aafeae581d06f81efac7c83 <
    028a7f4f3d69e551f6bf9f728d547bbf4cfc707d
  - >-
    Linux >= 0d44dc59b2b434b29aafeae581d06f81efac7c83 <
    25056329384010a8672552b134f609601dc4f80e
  - Linux 5a80273150a8a1725fa70418d106eb1f2ee8fd2f
  - Linux 82a8becb9c2c52fc5e67057a43aeded1f0731e7b
  - Linux 68845515c8b11791b547a2838e22c27dfa3115ee
  - Linux >= 2.6.27.22 < 2.6.28
  - Linux >= 2.6.28.10 < 2.6.29
  - Linux >= 2.6.29.3 < 2.6.30
  - Linux 2.6.30
published: '2026-09-24'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:17:59.963'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97506'
references:
  - url: 'https://git.kernel.org/stable/c/028a7f4f3d69e551f6bf9f728d547bbf4cfc707d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/04cb00106ca4d0fa9eca24cadc4eda6036e855c8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/25056329384010a8672552b134f609601dc4f80e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4918b0bd7d2baafb45d87dca9e322137c96005c2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8c37bc8d6a6f77bf9593fb1bcab6c14c7cf02991'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d4007867be42d71795b78fa7f8ce7514dda9ca83'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00161
epssPercentile: 0.05224
ingestedAt: '2026-09-24T16:47:15.862Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: ixp4xx - fix buffer chain unwind on allocation failure

chainup_buffers() builds a linked list of buffer descriptors for a
scatterlist. If dma_pool_alloc() fails while constructing the list, the
current code sets buf to NULL and later dereferences it unconditionally
at the end of the function:

  buf->next = NULL;
  buf->phys_next = 0;

This can lead to a null-pointer dereference on allocation failure.

If the failure happens after part of the descriptor chain has already
been allocated and DMA-mapped, the partially constructed chain also
needs to be released.

Fix this by terminating the partially constructed chain on allocation
failure and letting the callers unwind it via their existing cleanup
paths. Also fix ablk_perform() to preserve the hook pointers before
checking for failure, so partially built chains can be freed correctly.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.