Critical 10.0Published Aug 15, 2026

CVE-2026-74280crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

Updated under an hour ago (Oct 28, 2026, 1:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sg_cleanup path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one.

CVSS: 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 10b4f09491bfeb0b298cb2f49df585510ee6189a before 97f150ba3e372256eabb93bd80c2cf3740077fb5; 10b4f09491bfeb0b298cb2f49df585510ee6189a builds before 8a0db9fad3c97e6447a92417cb95d7c55eaa9530; 10b4f09491bfeb0b298cb2f49df585510ee6189a builds before 8d301e5a51173ba56ce4f632a2a33bf6b14b0fcf; from 10b4f09491bfeb0b298cb2f49df585510ee6189a before ed374dbc70c10c4a864414b3d9c257faec8fd485; 10b4f09491bfeb0b298cb2f49df585510ee6189a builds before 6c721a3e43344f8560ee4ef506fc1f72b4646dcd; 10b4f09491bfeb0b298cb2f49df585510ee6189a builds before 5f99a396f706afc749448659d1565991330e4f71; from 10b4f09491bfeb0b298cb2f49df585510ee6189a before acff30cfc0d72465b51b0bfdf019f1cb54e15314; from 10b4f09491bfeb0b298cb2f49df585510ee6189a before 7891c64c0520519782470ba29bac8a5761e295d8	CNA record

References

References

https://git.kernel.org/stable/c/97f150ba3e372256eabb93bd80c2cf3740077fb5
https://git.kernel.org/stable/c/8a0db9fad3c97e6447a92417cb95d7c55eaa9530
https://git.kernel.org/stable/c/8d301e5a51173ba56ce4f632a2a33bf6b14b0fcf
https://git.kernel.org/stable/c/ed374dbc70c10c4a864414b3d9c257faec8fd485
https://git.kernel.org/stable/c/6c721a3e43344f8560ee4ef506fc1f72b4646dcd
https://git.kernel.org/stable/c/5f99a396f706afc749448659d1565991330e4f71
https://git.kernel.org/stable/c/acff30cfc0d72465b51b0bfdf019f1cb54e15314
https://git.kernel.org/stable/c/7891c64c0520519782470ba29bac8a5761e295d8

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.