Executive brief
A vulnerability in the Linux kernel's cryptographic library could allow sensitive encryption keys to remain in system memory longer than necessary. Because the specific mathematical process used (ChaCha) is reversible, an attacker who gains access to this leftover memory could potentially reconstruct the original encryption keys. This could lead to the unauthorized decryption of secure data or a compromise of the system's random number generator.
Technical details
A data leakage vulnerability exists in lib/crypto/chacha.c (and chacha-block-generic.c) of the Linux kernel. The 'permuted_state' local variable, used during ChaCha cipher operations, was not zeroized before falling out of scope. Because the ChaCha permutation is mathematically invertible, the contents of this stack variable are sufficient to compute the original state and the underlying encryption key. An attacker with the ability to read kernel stack memory could exploit this to recover cryptographic keys or compromise the integrity of the Random Number Generator (RNG). The fix involves explicitly calling memzero_explicit or chacha_zeroize_state before the function returns.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-03-25: other: Vulnerability fix authored
- 2026-05-08: disclosed: CVE published
- 2026-05-08: patched: Patches released in various stable kernel branches
References
- https://git.kernel.org/stable/c/066c760acead1fb743bae294dbd89f479ae43b9b
- https://git.kernel.org/stable/c/1933249263c3a98df79992f61a566476e4163bcc
- https://git.kernel.org/stable/c/1d761e5a7340c46479fb2399598f331e4fe2c633
- https://git.kernel.org/stable/c/91999af43ca2125e3b2c18fcfc02912ada02efc3
- https://git.kernel.org/stable/c/b416a4245f04a450c67a13e6d96056c37c5b33fe
- https://git.kernel.org/stable/c/bd62d9b44464a6c20a34a74068e7a784d0afa04a
- https://git.kernel.org/stable/c/e5046823f8fa3677341b541a25af2fcb99a5b1e0