Executive brief
A vulnerability in the Linux kernel's crypto driver for Inside Secure EIP93 hardware can cause a system crash (kernel panic). This occurs when the system attempts to shut down or remove the driver on hardware that does not support all possible cryptographic algorithms. While primarily an availability issue, it could lead to unexpected service outages on affected platforms.
Technical details
The vulnerability exists in the 'inside-secure/eip93' crypto driver within the Linux kernel. The EIP93 hardware features an options register that specifies which cryptographic algorithms (e.g., AES, DES, SHA) are physically implemented in the silicon. While the driver correctly checks this register during the registration phase, the unregistration logic (specifically in 'eip93_unregister_algs') previously attempted to unregister all possible algorithms regardless of hardware support. On platforms where the hardware does not implement the full suite of options, this mismatch leads to a kernel panic during driver removal or system shutdown. The fix introduces a check against the hardware options register during the unregistration process to ensure only active algorithms are processed.
Affected products
- Linux Linux Kernel versions prior to 2026-01-30 patches
Timeline
- 2026-01-11: other: Patch authored
- 2026-01-30: patched: Mainline kernel patch committed
- 2026-05-27: disclosed: CVE published