CVE-2026-74279 crypto: cavium/cpt - fix DMA cleanup using wrong loop index
A logic error in the Cavium CPT crypto driver causes DMA buffer leaks and repeated unmapping, potentially leading to resource exhaustion or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74279?
CVE-2026-74279 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
The sg_cleanup error path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one.
Which versions are affected by CVE-2026-74279?
How do I fix CVE-2026-74279?
Apply the vendor's patch.
Is CVE-2026-74279 being exploited?
There is no known exploitation of CVE-2026-74279 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74279, DEBIAN-CVE-2026-74279, GHSA-4p2p-ww9m-h8rq, UBUNTU-CVE-2026-74279.