Executive brief
A vulnerability in the Linux kernel's crypto driver for Inside Secure EIP-93 hardware can cause a system crash (kernel panic). This occurs when the driver is being detached or removed, which might happen during system maintenance or hardware reconfiguration. A system crash results in an immediate loss of availability for any services running on the affected machine.
Technical details
A vulnerability in the 'inside-secure/eip93' crypto driver within the Linux kernel can lead to a kernel panic during driver detachment. The root cause is a logic error in the 'eip93_unregister_algs' function where an incorrect iterator ('i' instead of 'j') is used when unregistering hash algorithms. This results in the same hash algorithm being unregistered multiple times, triggering a system crash. The issue is triggered during driver removal or detachment, typically requiring local administrative privileges or specific hardware events. Patches have been released in various stable kernel branches to ensure the correct iterator is used.
Affected products
- Linux Linux Kernel 9739f5f93b78 to fixed versions
Timeline
- 2025-12-30: other: Patch authored
- 2026-05-27: disclosed: CVE published