CVE-2026-80836
In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtio_crypto_dataq_akcipher_callback() sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the original request length. sg_copy_from_buffer() then reads that many bytes from the destination buffer; a backend reporting a larger length over-reads adjacent kernel heap into the caller's scatterlist (an out-of-bounds read). Clamp the reported length to the originally requested destination length. A conforming device reports no more than that, so valid results are unaffected.
Affected versions
Linux kernel versions
5.19
and later are affected. Fixed in
6.6.158,
6.12.111,
6.18.49,
7.1.13,
7.2.3,
7.3
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-80836?
CVE-2026-80836 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.19 onward and has been patched in 6.6.158, 6.12.111, 6.18.49 and others. CVE-2026-80836 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80836?
Yes. CVE-2026-80836 has been patched. Fixed versions include 6.6.158, 6.12.111, 6.18.49 and others. If you are running Linux kernel 5.19 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80836 actively exploited?
No. CVE-2026-80836 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.