Linux Kernel CVE-2026-45986

The ccree driver (drivers/crypto/ccree/) provides kernel-space support for hardware-accelerated cryptography via the ARM TrustZone CryptoCell IP block, found in certain ARM SoCs used in embedded, mobile, and IoT platforms. The cc_mac_digest() function orchestrates a MAC (Message Authentication Code) operation by mapping input/output DMA buffers and submitting hardware requests. CWE-401 (Missing Release of Memory after Effective Lifetime) applies here: when cc_map_hash_request_final() encounters an error and returns early, the code path does not invoke cc_unmap_result() to release the previously allocated result buffer mapping, leaving it permanently leaked in kernel address space. On systems without CryptoCell hardware or with the ccree module not loaded, this code path is entirely unreachable. The CPE confirms the affected product as cpe:2.3:o:linux:linux_kernel across multiple stable branches, introduced at commit 63893811b0fcb52f6eaf9811cc08bddd46f81c3e (Linux 4.17).