Linux vulnerability

What happened

In the Linux kernel, the following vulnerability has been resolved: crypto: ixp4xx - fix buffer chain unwind on allocation failure chainup_buffers() builds a linked list of buffer descriptors for a scatterlist. If dma_pool_alloc() fails while constructing the list, the current code sets buf to NULL and later dereferences it unconditionally at the end of the function: buf->next = NULL; buf->phys_next = 0; This can lead to a null-pointer dereference on allocation failure. If the failure happens after part of the descriptor chain has already been allocated and DMA-mapped, the partially constructed chain also needs to be released. Fix this by terminating the partially constructed chain on allocation failure and letting the callers unwind it via their existing cleanup paths. Also fix ablk_perform() to preserve the hook pointers before checking for failure, so partially built chains can be freed correctly.

Affected versions

Linux: 0d44dc59b2b434b29aafeae581d06f81efac7c83 through before 04cb00106ca4d0fa9eca24cadc4eda6036e855c8 (git); 0d44dc59b2b434b29aafeae581d06f81efac7c83 through before 028a7f4f3d69e551f6bf9f728d547bbf4cfc707d (git); 0d44dc59b2b434b29aafeae581d06f81efac7c83 through before 25056329384010a8672552b134f609601dc4f80e (git); 5a80273150a8a1725fa70418d106eb1f2ee8fd2f (git); 82a8becb9c2c52fc5e67057a43aeded1f0731e7b (git); 68845515c8b11791b547a2838e22c27dfa3115ee (git); 2.6.27.22 through before 2.6.28 (semver); 2.6.28.10 through before 2.6.29 (semver); 2.6.29.3 through before 2.6.30 (semver); 2.6.30 Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.