CVE-2026-80836

In the Linux kernel, the following vulnerability has been resolved:

crypto: virtio - bound the akcipher result length

virtio crypto dataq akcipher callback() sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the original request length. sg copy from buffer() then reads that many bytes from the destination buffer; a backend reporting a larger length over-reads adjacent kernel heap into the caller's scatterlist (an out-of-bounds read).

Clamp the reported length to the originally requested destination length. A conforming device reports no more than that, so valid results are unaffected.