CVE-2026-80945
A critical flaw in the Linux kernel’s IAA crypto module can corrupt data during decompression when a hardware error triggers a software fallback while the destination buffer is still mapped for DMA. The bug causes stale bounce buffer data to be copied back, leading to incorrect results. The issue has been fixed in the kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (any distribution using the affected kernel version).
Real-world impact
An attacker could cause data corruption during decompression, potentially leading to incorrect data being processed or stored by applications that rely on the IAA crypto module.
Why this severity
The CVSS score of 9.1 reflects the high impact on confidentiality and integrity, with no authentication or user interaction required. The flaw allows an attacker to trigger a hardware error that leads to a software fallback, which writes stale data to the destination buffer.
What to do about it
- 01Update the Linux kernel to a patched version that includes the fix for CVE-2026-80945.
- 02Restart the system to ensure the new kernel is active.
NVD description indicates the vulnerability has been resolved in the Linux kernel.
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.