CVE-2026-93161crypto: qat - clear AES key schedule from stack
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 before b9cf42622b30178f554fa74411eec67e02d70411; from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 before fb1194b78a163cc56bb9480c707fc34b53522359; 5106dfeaeabea73d5132daab1d89d57b57fa98b7 builds before 892f34dc1819cceb8841005a68086710ce3763b6; from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 before dcaa0f1e86cbcb01f68131ae907b54cf299a3592; 5106dfeaeabea73d5132daab1d89d57b57fa98b7 builds before 9af019e213ada5c3d0d33c515071a1414b6899f3; 5106dfeaeabea73d5132daab1d89d57b57fa98b7 builds before 92e4979e1a770860b26aa3d90cce0c4c6a53833c; from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 before d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9 | CNA record |
References
- https://git.kernel.org/stable/c/b9cf42622b30178f554fa74411eec67e02d70411
- https://git.kernel.org/stable/c/fb1194b78a163cc56bb9480c707fc34b53522359
- https://git.kernel.org/stable/c/892f34dc1819cceb8841005a68086710ce3763b6
- https://git.kernel.org/stable/c/dcaa0f1e86cbcb01f68131ae907b54cf299a3592
- https://git.kernel.org/stable/c/9af019e213ada5c3d0d33c515071a1414b6899f3
- https://git.kernel.org/stable/c/92e4979e1a770860b26aa3d90cce0c4c6a53833c
- https://git.kernel.org/stable/c/d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.