CVE-2026-80836

A flaw was found in the Linux kernel's virtio crypto driver. A malicious backend device could report a result length larger than the allocated buffer during an asynchronous cipher operation. This could lead to an out-of-bounds read, allowing the device to access adjacent kernel memory. This vulnerability could result in information disclosure from the kernel heap.

A kernel heap out of bounds read in the virtio crypto akcipher callback occurs because the result length reported by the virtio crypto backend is assigned to akcipher_req dst_len without being bounded by the originally allocated destination buffer size. A malicious or non conforming backend can report a larger result length, causing sg_copy_from_buffer to read past vc_akcipher_req dst_buf and copy adjacent kernel heap bytes into the callers scatterlist. For the CVSS the PR:N is used in the paranoid virtualization threat model because a malicious virtio backend or device does not need privileges inside the guest OS, while the base local requester model can be treated as PR:L when a guest user must initiate the crypto request. The issue is not Internet network reachable and is specific to systems using virtio crypto with akcipher operations. Impact is primarily confidentiality loss through kernel heap information disclosure, with possible limited availability impact if the over read faults or destabilizes the guest kernel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.