CVE-2025-38300

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()

Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare():

1] If dma_map_sg() fails for areq->dst, the device driver would try to free

DMA memory it has not allocated in the first place. To fix this, on the

"theend_sgs" error path, call dma unmap only if the corresponding dma

map was successful.

2] If the dma_map_single() call for the IV fails, the device driver would

try to free an invalid DMA memory address on the "theend_iv" path:

------------[ cut here ]------------

DMA-API: sun8i-ce 1904000.crypto: device driver tries to free an invalid DMA memory address

WARNING: CPU: 2 PID: 69 at kernel/dma/debug.c:968 check_unmap+0x123c/0x1b90

Modules linked in: skcipher_example(O+)

CPU: 2 UID: 0 PID: 69 Comm: 1904000.crypto- Tainted: G O 6.15.0-rc3+ #24 PREEMPT

Tainted: [O]=OOT_MODULE

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References