CVE-2026-46291

Analyzed Analyzed - Analysis Complete

HMAC Key Leak in Linux Kernel Crypto CAAM

Publication date: 2026-06-08

Last updated on: 2026-07-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: caam - guard HMAC key hex dumps in hash_digest_key Use print_hex_dump_devel() for dumping sensitive HMAC key bytes in hash_digest_key() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-08

Last Modified

2026-07-08

Generated

2026-07-19

AI Q&A

2026-06-08

EPSS Evaluated

2026-07-18

NVD

CVE-2026-46291

EUVD

EUVD-2026-35157

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.30 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.7 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.88 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 3.6 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's crypto subsystem, specifically in the caam module. It involves the improper handling of HMAC key data during debugging. When the CONFIG_DYNAMIC_DEBUG option is enabled, sensitive HMAC key bytes could be exposed through hex dumps at runtime because the function hash_digest_key() did not properly guard these secrets.

The issue was resolved by changing the way the key bytes are dumped, using print_hex_dump_devel() to prevent leaking sensitive HMAC key information during debugging.

Impact Analysis

If exploited, this vulnerability could lead to the exposure of sensitive HMAC keys during runtime when dynamic debugging is enabled. This exposure could allow attackers or unauthorized users to obtain cryptographic keys, potentially compromising the integrity and authenticity of data protected by these keys.

Mitigation Strategies

The vulnerability is resolved by using print_hex_dump_devel() for dumping sensitive HMAC key bytes in hash_digest_key() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

Therefore, to mitigate this vulnerability, you should update your Linux kernel to a version where this fix is applied.

Hi! I’m here to help you understand CVE-2026-46291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70