Description

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMA_FROM_DEVICE. With SWIOTLB active the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result. Unmap before the fallback runs. The async path unmaps inline; the sync path signals the retry with -EAGAIN so iaa_comp_adecompress() runs the fallback after unmapping.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T20:19:00.057Z",
  "pubdate": "2026-09-11T20:19:00.057Z",
  "executiveSummary": "This vulnerability involves a memory inconsistency issue within the Linux kernel's IAA (Intel Analytics Accelerator) crypto driver during decompression operations. The flaw originates from improper DMA mapping management when a hardware analytics error triggers a fallback to the software-based decompression path.\nThe vulnerability type is a race condition/memory corruption resulting in stale data usage. By failing to unmap the destination buffer before the software fallback writes to it, the system inadvertently permits the SWIOTLB (Software Input/Output Translation Lookaside Buffer) to overwrite the valid decompressed output with stale bounce buffer data upon dma_unmap_sg() invocation.\nThe affected component is the crypto/iaa driver. This flaw poses a critical risk to data integrity, as successful exploitation results in corrupted memory being returned to the application layer. An attacker capable of triggering specific hardware analytics errors—potentially through crafted input streams—can force the kernel to execute the flawed fallback path, leading to system-wide memory corruption or silent data integrity failures.\nNo specific authentication or network access is required beyond the ability to interact with the kernel's cryptographic interface, making this a local privilege escalation or denial-of-service vector depending on the context of the calling application.",
  "technicalDetails": "The root cause of the vulnerability lies in a DMA synchronization violation within the iaa_comp_adecompress() function and associated synchronous decompression paths. When the Intel Analytics Accelerator (IAA) hardware encounters an analytics error during a decompression request, the kernel logic initiates a fallback mechanism to process the data using CPU-based software decompression.\nThe failure occurs because the destination buffer (req->dst) remains mapped with the DMA_FROM_DEVICE attribute while the CPU attempts to write to the underlying memory address during the software fallback. In environments where the Software Input/Output Translation Lookaside Buffer (SWIOTLB) is active, the kernel allocates a bounce buffer to facilitate DMA transactions. The hardware is expected to write the decompressed data into this bounce buffer, which is subsequently copied to the actual destination.\nThe attack flow follows a precise sequence: 1) A decompression request is initiated, and memory is mapped for hardware access via dma_map_sg(). 2) An analytics error occurs during the hardware operation. 3) The kernel driver initiates the software fallback path to complete the decompression. 4) The software path writes to req->dst directly while the mapping remains active. 5) Subsequently, when dma_unmap_sg() is called, the SWIOTLB logic triggers a synchronization back from the bounce buffer to the destination. Because the hardware error interrupted the process, the bounce buffer contains stale data. The unmapping operation effectively overwrites the CPU-processed data with this stale information from the bounce buffer.\nThis behavior leads to the corruption of the result buffer. Since the software fallback operates with the expectation that it has successfully decompressed the payload, the kernel proceeds to provide the caller with an output buffer containing incorrect, corrupted data. An adversary capable of manipulating input data to consistently trigger hardware analytics errors can leverage this behavior to inject controlled corruption into memory buffers managed by the kernel or user-space applications. This facilitates a variety of post-exploitation outcomes, including bypassing cryptographic integrity checks, altering application logic, or inducing crashes in processes that expect correctly decompressed data structures."
}