CVE-2026-80836

In the Linux kernel, the following vulnerability has been resolved:

crypto: virtio - bound the akcipher result length

virtio_crypto_dataq_akcipher_callback() sets the result length from the

device-reported response length without bounding it to the destination

buffer, which was allocated for the original request length.

sg_copy_from_buffer() then reads that many bytes from the destination

buffer; a backend reporting a larger length over-reads adjacent kernel

heap into the caller's scatterlist (an out-of-bounds read).

Clamp the reported length to the originally requested destination length.

A conforming device reports no more than that, so valid results are

unaffected.