CVE-2026-43044 (GCVE-0-2026-43044)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:15 – Updated: 2026-08-05 12:25
VLAI
Title
crypto: caam - fix DMA corruption on long hmac keys
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix DMA corruption on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be rounded to DMA cache alignment, as otherwise the hashed key may corrupt neighbouring memory. The rounding was performed, but never actually used for the allocation. Fix this by replacing kmemdup with kmalloc for a larger buffer, followed by memcpy.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < a7ecf06d3ee06e9b3322e1e7b003ea5c6f6e135a (git)
Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < c0c133e0225d87aad326bb90bbce9bdd6fde3cbb (git)
Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < 68feed135a0c7243a9275ae7e6a18260f755f52b (git)
Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < f2af8be110bde26b3e3354efdfdda97f426306a4 (git)
Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < 5ddfdcbe10dc5f97afc4e46ca22be2be717e8caf (git)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.134 , ≤ 6.6.* (semver)
Unaffected: 6.12.81 , ≤ 6.12.* (semver)
Unaffected: 6.18.22 , ≤ 6.18.* (semver)
Unaffected: 6.19.12 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/caamhash.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7ecf06d3ee06e9b3322e1e7b003ea5c6f6e135a",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "c0c133e0225d87aad326bb90bbce9bdd6fde3cbb",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "68feed135a0c7243a9275ae7e6a18260f755f52b",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "f2af8be110bde26b3e3354efdfdda97f426306a4",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "5ddfdcbe10dc5f97afc4e46ca22be2be717e8caf",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/caamhash.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - fix DMA corruption on long hmac keys\n\nWhen a key longer than block size is supplied, it is copied and then\nhashed into the real key.  The memory allocated for the copy needs to\nbe rounded to DMA cache alignment, as otherwise the hashed key may\ncorrupt neighbouring memory.\n\nThe rounding was performed, but never actually used for the allocation.\nFix this by replacing kmemdup with kmalloc for a larger buffer,\nfollowed by memcpy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable CAAM HMAC setkey path is reachable from local kernel crypto consumers, most directly by an unprivileged process using AF_ALG hash sockets and ALG_SET_KEY with a long HMAC key. I did not find a defensible unauthenticated network path because the bug is in key setup, not packet/data processing.\nAC:L - The attacker can choose the HMAC algorithm and key length/content and can repeatedly invoke the setkey path; no race or condition outside attacker control is required to trigger the DMA cache-alignment violation on affected CAAM deployments.\nPR:L - The AF_ALG userspace crypto API permits a normal local user to bind to hash/HMAC algorithms and call setsockopt(ALG_SET_KEY) without a capability check. Other paths such as XFRM require CAP_NET_ADMIN, but AF_ALG provides a low-privilege path.\nUI:N - No victim action is required after the attacker has local execution; the trigger is a direct syscall sequence by the attacker.\nS:U - The corruption occurs within kernel memory while servicing a kernel crypto API request. This is not a guest-to-host escape or an IOMMU/DMA isolation boundary bypass.\nC:H - The bug causes neighboring kernel memory corruption through an improperly sized DMA-mapped buffer. Following the required uncertainty rule, kernel memory corruption is treated as potentially exploitable for high-impact information disclosure.\nI:H - The issue corrupts adjacent kernel memory, and heap/DMA corruption can potentially be shaped into object manipulation or code execution. Under the required higher-severity rule, this warrants high integrity impact.\nA:H - Neighboring kernel memory corruption can readily cause an oops, panic, or hang. The attacker can trigger the condition repeatedly through local crypto API calls."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:31.725Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7ecf06d3ee06e9b3322e1e7b003ea5c6f6e135a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0c133e0225d87aad326bb90bbce9bdd6fde3cbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/68feed135a0c7243a9275ae7e6a18260f755f52b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2af8be110bde26b3e3354efdfdda97f426306a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ddfdcbe10dc5f97afc4e46ca22be2be717e8caf"
        }
      ],
      "title": "crypto: caam - fix DMA corruption on long hmac keys",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43044",
    "datePublished": "2026-05-01T14:15:40.317Z",
    "dateReserved": "2026-05-01T14:12:55.979Z",
    "dateUpdated": "2026-08-05T12:25:31.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43044",
      "date": "2026-08-10",
      "epss": "0.0012",
      "percentile": "0.02117"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43044\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T15:16:50.703\",\"lastModified\":\"2026-06-17T10:48:49.570\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: caam - fix DMA corruption on long hmac keys\\n\\nWhen a key longer than block size is supplied, it is copied and then\\nhashed into the real key.  The memory allocated for the copy needs to\\nbe rounded to DMA cache alignment, as otherwise the hashed key may\\ncorrupt neighbouring memory.\\n\\nThe rounding was performed, but never actually used for the allocation.\\nFix this by replacing kmemdup with kmalloc for a larger buffer,\\nfollowed by memcpy.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/crypto/caam/caamhash.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"199354d7fb6eaa2cc5bb650af0bca624baffee35\",\"lessThan\":\"a7ecf06d3ee06e9b3322e1e7b003ea5c6f6e135a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"199354d7fb6eaa2cc5bb650af0bca624baffee35\",\"lessThan\":\"c0c133e0225d87aad326bb90bbce9bdd6fde3cbb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"199354d7fb6eaa2cc5bb650af0bca624baffee35\",\"lessThan\":\"68feed135a0c7243a9275ae7e6a18260f755f52b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"199354d7fb6eaa2cc5bb650af0bca624baffee35\",\"lessThan\":\"f2af8be110bde26b3e3354efdfdda97f426306a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"199354d7fb6eaa2cc5bb650af0bca624baffee35\",\"lessThan\":\"5ddfdcbe10dc5f97afc4e46ca22be2be717e8caf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/crypto/caam/caamhash.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.134\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.81\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.22\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.12\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.134\",\"matchCriteriaId\":\"E87FA488-9C69-4C4C-9BBB-60BC7AC3E49C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.81\",\"matchCriteriaId\":\"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.22\",\"matchCriteriaId\":\"C9DF8BCE-36D3-475D-9D21-19E4F02F9029\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.12\",\"matchCriteriaId\":\"0A2B9540-02D5-41B4-B16A-82AF66FD4F36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5ddfdcbe10dc5f97afc4e46ca22be2be717e8caf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/68feed135a0c7243a9275ae7e6a18260f755f52b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7ecf06d3ee06e9b3322e1e7b003ea5c6f6e135a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0c133e0225d87aad326bb90bbce9bdd6fde3cbb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f2af8be110bde26b3e3354efdfdda97f426306a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T12:49:34+00:00",
      "cve": "CVE-2026-43044",
      "id": "CVE-2026-43044",
      "initial_release_date": "2026-05-01T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: crypto: caam - fix DMA corruption on long hmac keys",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43044.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-03T03:14:53Z",
      "cve": "CVE-2026-43044",
      "id": "CVE-2026-43044",
      "initial_release_date": "2026-05-06T01:40:55Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "192",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43044",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43044.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.