CVE-2026-80832 crypto: qce - fix CCM AAD buffer underallocation
A buffer underallocation in the Linux kernel QCE crypto driver allows out-of-bounds reads, potentially causing denial of service or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80832?
CVE-2026-80832 is a memory corruption vulnerability in Linux, published on 4 Sep 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: qce - fix CCM AAD buffer underallocation
The AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen() can be smaller than the length later programmed into the DMA scatterlist.
The allocation size is currently calculated as:
ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN
while the DMA length is set to:
ALIGN(assoclen + adata_header_len, 16)
Since ALIGN() does not distribute over addition, the allocation can be smaller than the DMA length. For example, when assoclen = 32 and adata_header_len = 2:
allocation = ALIGN(32, 16) + 6 = 38 DMA length = ALIGN(32 + 2, 16) = 48
As a result, the QCE hardware can read beyond the allocated buffer while computing the CBC-MAC over the associated data. The extra bytes are folded into the authentication tag, resulting in an incorrect tag and causing CCM self-test failures such as:
alg: aead: ccm-aes-qce encryption test failed (wrong result) on test vector 8
Fix the allocation by adding the maximum possible AAD header length before alignment:
ALIGN(assoclen + MAX_CCM_ADATA_HEADER_LEN, 16)
This guarantees that the allocated buffer is large enough for the fully padded AAD data for all supported header sizes.
Which versions are affected by CVE-2026-80832?
How do I fix CVE-2026-80832?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-80832 being exploited?
There is no known exploitation of CVE-2026-80832 in the wild and no public exploit code.
Sources
Also known as AZL-99567, BELL-CVE-2026-80832, DEBIAN-CVE-2026-80832, GHSA-5ch2-359f-fp8j, UBUNTU-CVE-2026-80832.