Linux Kernel CVE-2026-45937

The vulnerability resides in the Inside Secure EIP-93 hardware crypto driver (drivers/crypto/inside-secure/eip93) within the Linux kernel. The EIP-93 is a cryptographic accelerator IP core used in embedded systems and networking hardware. During the driver detach/cleanup path, a defective loop iterator causes the driver to invoke the kernel crypto subsystem's algorithm deregistration function on the same hash algorithm object multiple times. The crypto subsystem cannot safely handle double-unregistration of an already-freed or invalidated algorithm entry, triggering a kernel panic. The root cause is a logic error in resource cleanup, analogous to CWE-415 (Double Free) or CWE-672 (Operation on Resource after Expiration), though no CWE has been officially assigned. The CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* covers all affected kernel versions from the introducing commit onward. Notably, the EUVD tag 'Information Disclosure' is contradicted by the CVSS vector (C:N), which confirms no confidentiality impact; the sole real-world impact is availability via kernel crash.