{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43330", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.002Z", "datePublished": "2026-05-08T13:31:18.133Z", "dateUpdated": "2026-08-05T12:27:16.367Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:16.367Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - fix overflow on long hmac keys\n\nWhen a key longer than block size is supplied, it is copied and then\nhashed into the real key. The memory allocated for the copy needs to\nbe rounded to DMA cache alignment, as otherwise the hashed key may\ncorrupt neighbouring memory.\n\nThe copying is performed using kmemdup, however this leads to an overflow:\nreading more bytes (aligned_len - keylen) from the keylen source buffer.\nFix this by replacing kmemdup with kmalloc, followed by memcpy." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - An attacker reaches the vulnerable CAAM HMAC `ahash_setkey` path locally through the unprivileged `AF_ALG` hash socket interface and `setsockopt(ALG_SET_KEY)`. There is no remotely supplied packet or adjacent-link protocol path that directly chooses this HMAC key.\nAC:L - The attacker directly controls the algorithm selection and long key length, and triggering only requires supplying a key longer than the hash block size on a system with the CAAM QI2 driver registered. No race or victim-controlled timing condition is required.\nPR:L - Creating and using `AF_ALG` hash sockets does not require administrative capabilities, so any local unprivileged user can invoke the setkey path. It is therefore Low privileges, not High.\nUI:N - No victim action is needed after the attacker has local code execution; the attacker can open the socket, bind the HMAC algorithm, and set the key themselves.\nS:U - The vulnerability is in kernel crypto driver handling and impacts the same kernel security authority. It does not cross a VM, IOMMU, or separate authorization boundary.\nC:H - The bug is an out-of-bounds kernel heap read from the temporary key buffer by up to DMA cache-alignment padding, and repeated attacker-controlled invocations can expose sensitive adjacent kernel memory. Under the conservative rule, this kernel OOB read is scored as High confidentiality impact.\nI:H - The affected long-key path is kernel DMA/HMAC key handling where incorrect aligned-buffer handling is associated with neighboring memory corruption, and exploitation of kernel memory-safety bugs can plausibly yield arbitrary modification or code execution. Under the required higher-severity tie-break, integrity is High.\nA:H - The overflow can trigger kernel memory safety failures such as KASAN reports, faults, oopses, or DMA-related corruption in kernel memory. This is sufficient for High availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/caam/caamalg_qi2.c" ], "versions": [ { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "31022cfde5235c45fa765f0aabeff5f0652852f2", "status": "affected", "versionType": "git" }, { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "c2fb4984fe09fc176fe4c12d5e3edf626df6511d", "status": "affected", "versionType": "git" }, { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "aa545df011338df13f0833fc1fabcb15c0521959", "status": "affected", "versionType": "git" }, { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "cebc5ebd958346195b77f42d0cd5141b4e448fae", "status": "affected", "versionType": "git" }, { "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35", "lessThan": "80688afb9c35b3934ce2d6be9973758915e2e0ef", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/caam/caamalg_qi2.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.134" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.81" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.22" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.19.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/31022cfde5235c45fa765f0aabeff5f0652852f2" }, { "url": "https://git.kernel.org/stable/c/c2fb4984fe09fc176fe4c12d5e3edf626df6511d" }, { "url": "https://git.kernel.org/stable/c/aa545df011338df13f0833fc1fabcb15c0521959" }, { "url": "https://git.kernel.org/stable/c/cebc5ebd958346195b77f42d0cd5141b4e448fae" }, { "url": "https://git.kernel.org/stable/c/80688afb9c35b3934ce2d6be9973758915e2e0ef" } ], "title": "crypto: caam - fix overflow on long hmac keys", "x_generator": { "engine": "bippy-1.2.0" } } } }