Executive brief
A vulnerability in the Linux kernel's Cryptographic Acceleration and Assurance Module (CAAM) could allow sensitive security keys to be leaked into system logs. This occurs when specific debug settings are enabled, potentially exposing cryptographic secrets to local users or monitoring tools that have access to system messages. This could compromise the confidentiality of encrypted data or secure communications handled by the affected hardware.
Technical details
An information disclosure vulnerability exists in the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver. The function 'hash_digest_key()' in 'drivers/crypto/caam/caamhash.c' and 'drivers/crypto/caam/caamalg_qi2.c' used 'print_hex_dump_debug()' to output HMAC key bytes. When the kernel is compiled with 'CONFIG_DYNAMIC_DEBUG' and the specific debug category is enabled at runtime, these sensitive keys are written to the kernel log (dmesg). An attacker with local access to system logs could recover these keys. The fix replaces the debug calls with 'print_hex_dump_devel()', which ensures the data is only dumped in development environments and not in production builds with dynamic debugging enabled.
Affected products
- Linux Linux Kernel All versions prior to the June 2026 patches
Timeline
- 2026-03-19: other: Initial patch authored
- 2026-06-08: advisory: CVE-2026-46291 published
References
- https://git.kernel.org/stable/c/177730a273b18e195263ed953853273e901b5064
- https://git.kernel.org/stable/c/2adbfca7452eeac45117b8e803288a2767f7075f
- https://git.kernel.org/stable/c/5cffe3c136891aa4d579bf5c079a68f7cb371b0c
- https://git.kernel.org/stable/c/b8f12d9b00c1950779e5679b9c13908584682bb6
- https://git.kernel.org/stable/c/c7e52fe3f7901ccb9cd29b3f7c683d809ba87e48