{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43044", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.979Z", "datePublished": "2026-05-01T14:15:40.317Z", "dateUpdated": "2026-08-05T12:25:31.725Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:31.725Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - fix DMA corruption on long hmac keys\n\nWhen a key longer than block size is supplied, it is copied and then\nhashed into the real key. The memory allocated for the copy needs to\nbe rounded to DMA cache alignment, as otherwise the hashed key may\ncorrupt neighbouring memory.\n\nThe rounding was performed, but never actually used for the allocation.\nFix this by replacing kmemdup with kmalloc for a larger buffer,\nfollowed by memcpy." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable CAAM HMAC setkey path is reachable from local kernel crypto consumers, most directly by an unprivileged process using AF_ALG hash sockets and ALG_SET_KEY with a long HMAC key. I did not find a defensible unauthenticated network path because the bug is in key setup, not packet/data processing.\nAC:L - The attacker can choose the HMAC algorithm and key length/content and can repeatedly invoke the setkey path; no race or condition outside attacker control is required to trigger the DMA cache-alignment violation on affected CAAM deployments.\nPR:L - The AF_ALG userspace crypto API permits a normal local user to bind to hash/HMAC algorithms and call setsockopt(ALG_SET_KEY) without a capability check. Other paths such as XFRM require CAP_NET_ADMIN, but AF_ALG provides a low-privilege path.\nUI:N - No victim action is required after the attacker has local execution; the trigger is a direct syscall sequence by the attacker.\nS:U - The corruption occurs within kernel memory while servicing a kernel crypto API request. This is not a guest-to-host escape or an IOMMU/DMA isolation boundary bypass.\nC:H - The bug causes neighboring kernel memory corruption through an improperly sized DMA-mapped buffer. Following the required uncertainty rule, kernel memory corruption is treated as potentially exploitable for high-impact information disclosure.\nI:H - The issue corrupts adjacent kernel memory, and heap/DMA corruption can potentially be shaped into object manipulation or code execution. Under the required higher-severity rule, this warrants high integrity impact.\nA:H - Neighboring kernel memory corruption can readily cause an oops, panic, or hang. The attacker can trigger the condition repeatedly through local crypto API calls." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/caam/caamhash.c" ], "versions": [ { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "a7ecf06d3ee06e9b3322e1e7b003ea5c6f6e135a", "status": "affected", "versionType": "git" }, { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "c0c133e0225d87aad326bb90bbce9bdd6fde3cbb", "status": "affected", "versionType": "git" }, { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "68feed135a0c7243a9275ae7e6a18260f755f52b", "status": "affected", "versionType": "git" }, { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "f2af8be110bde26b3e3354efdfdda97f426306a4", "status": "affected", "versionType": "git" }, { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "5ddfdcbe10dc5f97afc4e46ca22be2be717e8caf", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/caam/caamhash.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.134" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.81" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.22" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.19.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a7ecf06d3ee06e9b3322e1e7b003ea5c6f6e135a" }, { "url": "https://git.kernel.org/stable/c/c0c133e0225d87aad326bb90bbce9bdd6fde3cbb" }, { "url": "https://git.kernel.org/stable/c/68feed135a0c7243a9275ae7e6a18260f755f52b" }, { "url": "https://git.kernel.org/stable/c/f2af8be110bde26b3e3354efdfdda97f426306a4" }, { "url": "https://git.kernel.org/stable/c/5ddfdcbe10dc5f97afc4e46ca22be2be717e8caf" } ], "title": "crypto: caam - fix DMA corruption on long hmac keys", "x_generator": { "engine": "bippy-1.2.0" } } } }