Linux Kernel Crypto Algorithm Unregister Vulnerability

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: inside-secure/eip93 - unregister only available algorithm EIP93 has an options register. This register indicates which crypto algorithms are implemented in silicon. Supported algorithms are registered on this basis. Unregister algorithms on the same basis. Currently, all algorithms are unregistered, even those not supported by HW. This results in panic on platforms that don't have all options implemented in silicon.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45854

EUVD

EUVD-2026-32320

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.15 (inc) to 6.18.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's crypto subsystem, specifically in the inside-secure/eip93 module. The issue arises because the options register, which indicates which cryptographic algorithms are implemented in hardware silicon, is not properly used when unregistering algorithms. Instead of unregistering only the algorithms supported by the hardware, all algorithms are unregistered regardless of hardware support. This improper handling can cause a system panic on platforms where not all options are implemented in silicon.

Impact Analysis

The vulnerability can cause a system panic on affected platforms. This means that systems running the vulnerable Linux kernel may unexpectedly crash or become unstable if they rely on the inside-secure/eip93 crypto module on hardware that does not support all the crypto algorithms indicated by the options register. Such crashes can lead to denial of service and potential disruption of services or operations.

Hi! I’m here to help you understand CVE-2026-45854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70