Database/Control plane, storage & DevOps
Linux crypto driver for Marvell OCTEON TX: The scatter-gather cleanup path in the Marvell OCTEON TX crypto driver uses
Impact
The scatter-gather cleanup path in the Marvell OCTEON TX crypto driver uses the wrong loop index, so DMA mappings are torn down against the wrong entries. Getting DMA cleanup wrong on an accelerator is exactly the primitive that undermines IOMMU-based device isolation — the mapping that should have been revoked stays live, or a mapping belonging to something else is revoked. OCTEON is used both as a DPU and as an inline crypto/offload engine in storage and network appliances.
Who can reach it
Local, through the crypto API on a host with an OCTEON TX accelerator.
What to do
Kernel/driver upgrade plus host reboot. Nothing to flash. If you run OCTEON accelerators in a shared-tenancy role, verify IOMMU is enabled and enforcing on those devices as a standing control.
References
Related entries
- Linux VXLAN driver (neighbour hardware address read in route_shortcircuit): `route_shortcircuit()` reads a neighbour'sCVE-2026-74475 · Linux VXLAN driver (neighbour hardware address read in route_shortcircuit)Critical
- Cisco ISE: unauthenticated API endpoint allows full authentication bypass on the applianceCVE-2026-76460 · Cisco Identity Services Engine (unauthenticated API endpoint)Critical
- SonicWall SMA1000: pre-auth SSRF via an unintended alternate access path in the Work Place interfaceCVE-2026-83548 · SonicWall SMA1000 appliance (Work Place interface, alternate access path)Critical
- GitLab: unauthenticated arbitrary file read via the repository commits APICVE-2026-85706 · GitLab CE/EE (repository commits API)Critical
- Kubeflow Pipelines frontend (/_proxy/ route, proxy-middleware.ts): The pipelines frontend hands any unauthenticatedNCVD-2026-042-kubeflow-pipelines-frontend-prox · Kubeflow Pipelines frontend (/_proxy/ route, proxy-middleware.ts)Critical
- HTCondor (condor_credd): condor_credd can be told to create or write files as root outsideCVE-2021-25311 · HTCondor (condor_credd)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.