Executive brief
The Linux kernel's QAT crypto driver improperly clears sensitive AES encryption key material from stack memory during XTS mode key expansion. An attacker with local access to kernel memory could potentially extract cryptographic keys left behind in the stack frame, compromising the confidentiality of encrypted data.
Technical details
The vulnerability exists in the qat_alg_xts_reverse_key() function within the QAT (Intel QuickAssist Technology) crypto driver. The function expands the forward XTS AES key on the stack in a temporary crypto_aes_ctx structure containing sensitive key material. The root cause is the failure to zero-out this temporary structure after copying the required key data, allowing key material to persist in the kernel stack frame. An attacker with local kernel memory read access (via side-channel, physical access, or another vulnerability) could recover the AES key schedule. The fix, applied in commit d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9, adds a memzero_explicit() call to securely clear the temporary structure after use. This is a defense-in-depth improvement and is not known to be actively exploited.
Affected products
- Linux Linux kernel versions prior to patch commit d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9
Timeline
- 2026-09-17: disclosed
- 2026-06-08: patched: upstream patch authored