Security readout for executives and security teams
Plain-English summary
A Linux OMAP cryptography driver allocated too little memory when copying certain data lists. If triggered locally, the resulting kernel memory corruption could compromise confidentiality, integrity, and availability. The risk is serious but appears concentrated on systems using the affected OMAP crypto functionality rather than all Linux deployments.
Executive priority
Treat this as a high-priority targeted kernel update. Accelerate remediation for exposed multi-user or appliance systems using OMAP cryptography. Broader emergency action is not supported by current evidence because exploitation requires local access and active exploitation is unconfirmed.
Technical view
omap_crypto_copy_sg_lists() allocated space based on scatterlist pointers instead of scatterlist objects, producing an allocation four times too small. The correction uses sizeof(*new_sg). CVSS 3.1 rates the issue 7.8 with local access and low privileges required, no user interaction, and potentially high impact across confidentiality, integrity, and availability.
Likely exposure
Exposure is most likely on Linux systems containing and using the affected OMAP crypto driver, particularly OMAP-based devices. The supplied version metadata is ambiguous and should not be treated as a reliable package-level boundary. Distribution kernels may backport fixes, so build and commit status matter more than version strings alone.
Exploitation context
The supplied CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. The bundle reports that CVE-2026-23222 is not in KEV and provides no evidence of active exploitation or a public exploit. Exact trigger reachability and practical reliability are not documented in the supplied evidence.
Researcher notes
The root cause is a fourfold heap under-allocation in scatterlist copying. No CWE is supplied. Multiple stable-branch commits are referenced, but the bundle does not clearly map every distribution package or establish exploitability conditions. Researchers should avoid inferring universal Linux exposure from the product-level version entries.
Mitigation direction
- Apply a vendor-supported kernel update incorporating the applicable referenced stable fix.
- Check distribution or device-vendor guidance for corrected package versions and reboot requirements.
- Prioritize OMAP-based systems where the affected crypto driver is present or used.
- If no update is available, request vendor guidance; no source-named workaround is provided.
Validation and detection
- Inventory running kernel builds and identify systems containing or using the OMAP crypto driver.
- Compare each kernel source or vendor package with the referenced fix for its maintained branch.
- Confirm systems booted into the corrected kernel after installation.
- Regression-test legitimate cryptographic workloads on representative OMAP devices after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23222 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/953c81941b0ad373674656b8767c00234ebf17acCVE reference, Linux
- https://git.kernel.org/stable/c/31aff96a41ae6f1f1687c065607875a27c364da8CVE reference, Linux
- https://git.kernel.org/stable/c/79f95b51d4278044013672c27519ae88d07013d8CVE reference, Linux
- https://git.kernel.org/stable/c/6edf8df4bd29f7bfd245b67b2c31d905f1cfc14bCVE reference, Linux
- https://git.kernel.org/stable/c/c184341920ed78b6466360ed7b45b8922586c38fCVE reference, Linux
- https://git.kernel.org/stable/c/2ed27b5a1174351148c3adbfc0cd86d54072ba2eCVE reference, Linux
- https://git.kernel.org/stable/c/d1836c628cb72734eb5f7dfd4c996a9c18bba3adCVE reference, Linux
- https://git.kernel.org/stable/c/1562b1fb7e17c1b3addb15e125c718b2be7f5512CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.