Linux crypto iaa: DMA buffer not unmapped before software fallback corrupts decompressed data

Impact

On a hardware analytics error the IAA driver retries decompression in software while req->dst is still mapped DMA_FROM_DEVICE. With SWIOTLB active, the later dma_unmap_sg() copies the stale bounce buffer over the freshly written destination, so the caller silently receives corrupted output. Where IAA backs zswap or another in-kernel compression consumer, that is silent data corruption of pages in flight rather than an attacker-controlled primitive. Nodes affected are those with Intel IAA enabled and SWIOTLB in use; GPU hosts often run with an IOMMU/bounce-buffer configuration that makes the path reachable.

Who can reach it

Local, and not directly attacker-driven: the corruption requires a hardware analytics error on an IAA descriptor plus SWIOTLB bouncing. Any workload whose pages go through an IAA-backed compression path can be the victim; no authentication boundary is crossed.

What to do

Apply the stable kernel update containing the fix and reboot the node. As an interim mitigation on nodes where corruption risk is unacceptable, disable the IAA crypto driver (and any zswap backend using it) so compression falls back to software, which does not require a reboot on all setups but does require draining the workloads using it.

References

Related entries

• Linux fuse io-uring: request headers copied from a non-whitelisted slab object panics hardened usercopyCVE-2026-80946 · Linux kernel FUSE io-uring transport (fuse_request header usercopy)Unscored
• Linux net/smc: connection freed before tasklet drain leaves a use-after-free on the SMC-D receive pathCVE-2026-80979 · Linux kernel net/smc (SMC-D connection teardown vs. rx tasklet)Unscored
• Linux kernel net/smc: oversized SMC-Rv2 LLC messages let a peer delete or install RDMA rkeysCVE-2026-80985 · Linux kernel net/smc (SMC-Rv2 LLC rkey handling)Unscored
• Linux kernel net/smc: out-of-bounds read parsing the v2 extension on every SMC-Rv2 link additionCVE-2026-80986 · Linux kernel net/smc (SMC-Rv2 add-link v2 extension parsing)Unscored
• Linux kernel io_uring/query: unclamped user size lets a local task request ~4 GiB of clear_user zeroingCVE-2026-81009 · Linux kernel io_uring (IORING_REGISTER_QUERY, copy_struct_to_user size cap)Unscored
• Linux kernel io_uring/waitid: canceled task work runs __do_wait() in the wrong task contextCVE-2026-81010 · Linux kernel io_uring waitid (task_work cancellation handling)Unscored