CVE-2026-23222

Vulnerability

CVE-2026-23222 is a memory allocation error in the Linux kernel's OMAP cryptographic driver. The function omap_crypto_copy_sg_lists() allocates an array of scatterlist arrays using sizeof(*new_sg) incorrectly — it was using sizeof(new_sg) which gives the size of a pointer (8 bytes on 64-bit) rather than the size of a struct scatterlist (32 bytes). This results in an allocation that is 4 times too small, leading to out-of-bounds writes when the scatterlist is populated.

Exploitation

An attacker would need to trigger a cryptographic operation that invokes the OMAP crypto driver's scatterlist copy path. This typically requires local access to the system and the ability to submit crypto requests (e.g., via AF_ALG or a kernel crypto API user). No special privileges beyond being able to use the crypto subsystem are required. The bug manifests when the driver copies scatterlists for hardware crypto offload, causing writes beyond the allocated buffer.

Impact

Successful exploitation could lead to memory corruption, potentially allowing an attacker to escalate privileges or cause a denial of service (system crash). The CVSS v3 score of 7.8 (High) reflects the possibility of local privilege escalation with low attack complexity.

Mitigation

The fix corrects the allocation to use sizeof(*new_sg), ensuring the proper object size. Patches have been applied to the Linux kernel stable trees [1][2][3]. Users should update to a kernel version 6.14 or later to include the fix.