CVE-2026-74280crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sg_cleanup path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one.
- CVSS
- 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 10b4f09491bfeb0b298cb2f49df585510ee6189a before 97f150ba3e372256eabb93bd80c2cf3740077fb5; 10b4f09491bfeb0b298cb2f49df585510ee6189a builds before 8a0db9fad3c97e6447a92417cb95d7c55eaa9530; 10b4f09491bfeb0b298cb2f49df585510ee6189a builds before 8d301e5a51173ba56ce4f632a2a33bf6b14b0fcf; from 10b4f09491bfeb0b298cb2f49df585510ee6189a before ed374dbc70c10c4a864414b3d9c257faec8fd485; 10b4f09491bfeb0b298cb2f49df585510ee6189a builds before 6c721a3e43344f8560ee4ef506fc1f72b4646dcd; 10b4f09491bfeb0b298cb2f49df585510ee6189a builds before 5f99a396f706afc749448659d1565991330e4f71; from 10b4f09491bfeb0b298cb2f49df585510ee6189a before acff30cfc0d72465b51b0bfdf019f1cb54e15314; from 10b4f09491bfeb0b298cb2f49df585510ee6189a before 7891c64c0520519782470ba29bac8a5761e295d8 | CNA record |
References
- https://git.kernel.org/stable/c/97f150ba3e372256eabb93bd80c2cf3740077fb5
- https://git.kernel.org/stable/c/8a0db9fad3c97e6447a92417cb95d7c55eaa9530
- https://git.kernel.org/stable/c/8d301e5a51173ba56ce4f632a2a33bf6b14b0fcf
- https://git.kernel.org/stable/c/ed374dbc70c10c4a864414b3d9c257faec8fd485
- https://git.kernel.org/stable/c/6c721a3e43344f8560ee4ef506fc1f72b4646dcd
- https://git.kernel.org/stable/c/5f99a396f706afc749448659d1565991330e4f71
- https://git.kernel.org/stable/c/acff30cfc0d72465b51b0bfdf019f1cb54e15314
- https://git.kernel.org/stable/c/7891c64c0520519782470ba29bac8a5761e295d8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.