CVE-2026-97506 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
crypto: ixp4xx - fix buffer chain unwind on allocation failure
chainup_buffers() builds a linked list of buffer descriptors for a scatterlist. If dma_pool_alloc() fails while constructing the list, the current code sets buf to NULL and later dereferences it unconditionally at the end of the function:
buf->next = NULL; buf->phys_next = 0;
This can lead to a null-pointer dereference on allocation failure.
If the failure happens after part of the descriptor chain has already been allocated and DMA-mapped, the partially constructed chain also needs to be released.
Fix this by terminating the partially constructed chain on allocation failure and letting the callers unwind it via their existing cleanup paths. Also fix ablk_perform() to preserve the hook pointers before checking for failure, so partially built chains can be freed correctly.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in the Linux kernel's ixp4xx cryptographic driver represents a critical null-pointer dereference flaw arising from improper error handling during dynamic memory allocation operations. The core of this issue resides within the chainup_buffers function, which is responsible for constructing a linked list of buffer descriptors based on a provided scatterlist structure. This process involves allocating individual buffers using dma_pool_alloc and linking them together to facilitate efficient data transfer via Direct Memory Access. Under normal operational conditions where memory allocation succeeds without incident, the driver functions correctly by populating these descriptor structures with necessary metadata such as physical addresses and next-pointers for traversal. However, the implementation fails to account for scenarios where dma_pool_alloc returns a null pointer due to resource exhaustion or other system constraints.
When an allocation failure occurs mid-process, the existing code logic sets the current buffer reference to NULL but proceeds to execute subsequent lines of code that unconditionally dereference this variable. Specifically, the statements buf->next = NULL and buf->phys_next = 0 are executed regardless of whether buf holds a valid memory address or is null. This unconditional access results in a kernel panic or system crash because the processor attempts to write to an invalid virtual address space associated with a null pointer. In the context of operating systems, such errors typically trigger a segmentation fault within the kernel mode, leading to immediate service disruption and potential data corruption if the affected subsystem handles critical security operations like encryption or decryption.
Beyond the immediate crash risk, this vulnerability exposes deeper architectural flaws in how partially constructed resources are managed during failure states. If dma_pool_alloc fails after several descriptors have already been successfully allocated and mapped for DMA usage, those previously acquired resources remain orphaned within the system memory pool. The original code does not implement a cleanup routine to release these partial allocations before returning control to the caller. This leads to resource leaks where kernel memory is consumed but never freed, gradually degrading system performance over time until further allocation attempts fail entirely. Furthermore, in cryptographic contexts involving asynchronous block cipher operations performed by ablk_perform, failure handling must preserve hook pointers to ensure that any partially built chains can be correctly identified and deallocated through existing cleanup paths. Without preserving these references, the driver loses track of allocated structures, exacerbating memory leakage issues.
From a classification perspective, this vulnerability aligns with CWE-476, which denotes NULL Pointer Dereference, as it involves accessing memory via an uninitialized or null pointer value leading to undefined behavior and system instability. Additionally, the failure to properly release resources upon allocation error corresponds closely to CWE-401, representing Missing Release of Memory after Effective Lifetime, although in this specific case, the primary immediate impact is stability rather than long-term leak accumulation alone. In terms of adversarial tactics, while this flaw does not directly enable privilege escalation or remote code execution on its own, it can be leveraged within an ATT&CK framework context under T1499 Endpoint Denial of Service. An attacker who can trigger repeated allocation failures in a targeted cryptographic routine could induce persistent system crashes, effectively denying service to legitimate users and administrators relying on the affected hardware acceleration features for secure communications or data integrity checks.
Mitigation strategies must address both immediate code corrections and broader defensive programming practices within kernel development. The primary fix involves modifying chainup_buffers to check the return value of dma_pool_alloc before attempting any field assignments, ensuring that buf is validated as non-null prior to dereference. If allocation fails after partial construction, the function should terminate the current list by setting the last valid next pointer appropriately and allow higher-level callers to handle the unwinding process using their established cleanup mechanisms. Similarly, ablk_perform must be updated to save hook pointers before checking for allocation success, ensuring that even in failure scenarios, the driver retains sufficient context to free any allocated descriptors correctly. System administrators should apply kernel patches promptly once available from distribution vendors or upstream maintainers. Long-term resilience can be enhanced by implementing robust error handling patterns across all DMA-related code paths and utilizing static analysis tools during development phases to detect potential null dereferences before deployment into production environments.