Skip to main content

Linux Kernel EUVDEUVD-2026-28614

| CVE-2026-43330 HIGH
Out-of-bounds Write (CWE-787)
2026-05-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-7669-mcjm-pwg9
Buffer Overflow Linux Memory Corruption Red Hat
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 11, 2026 - 08:24 vuln.today
CVSS changed
May 11, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
May 08, 2026 - 15:02 EUVD
CVE Published
May 08, 2026 - 14:16 nvd
HIGH 7.8
CVE Published
May 08, 2026 - 14:16 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: caam - fix overflow on long hmac keys

When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be rounded to DMA cache alignment, as otherwise the hashed key may corrupt neighbouring memory.

The copying is performed using kmemdup, however this leads to an overflow: reading more bytes (aligned_len - keylen) from the keylen source buffer. Fix this by replacing kmemdup with kmalloc, followed by memcpy.

AnalysisAI

Buffer overflow in the Linux kernel's CAAM crypto driver allows local authenticated attackers to corrupt memory and potentially execute arbitrary code with elevated privileges. The vulnerability occurs when HMAC keys exceeding the algorithm's block size are processed - the driver allocates DMA-aligned memory but uses kmemdup() to copy only the actual key length, then reads beyond the source buffer boundary during hashing. EPSS score of 0.02% (5th percentile) indicates low predicted exploitation likelihood. Patches are available across multiple stable kernel branches (6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0) via upstream commits, with fixes applied since kernel 6.3 introduced the vulnerable code.

Technical ContextAI

The vulnerability resides in the Linux kernel's Cryptographic Accelerator and Assurance Module (CAAM) driver, which provides hardware-accelerated cryptographic operations on NXP/Freescale processors. When processing HMAC operations with keys longer than the hash algorithm's block size (e.g., >64 bytes for SHA-256), the CAAM driver must first hash the key to derive a block-sized key. The code allocates a DMA cache-aligned buffer but uses kmemdup(keylen) to copy the original key, then reads aligned_len bytes during the hashing operation - causing an out-of-bounds read of (aligned_len - keylen) bytes from the source buffer. This violates DMA memory alignment requirements and can corrupt adjacent kernel memory structures. The fix replaces kmemdup() with kmalloc() plus explicit memcpy() to ensure only valid source bytes are copied into the aligned destination buffer. This is a classic buffer over-read vulnerability introduced in the CAAM driver's key handling logic.

RemediationAI

Upgrade to patched Linux kernel versions: 6.6.134 or later for the 6.6 LTS series, 6.12.81+ for the 6.12 series, 6.18.22+ for 6.18 series, 6.19.12+ for 6.19 series, or 7.0 stable release. Patches are available from distribution vendors following their normal kernel update channels (apt update && apt upgrade for Debian/Ubuntu, yum update kernel for RHEL/CentOS, etc.). For systems requiring the CAAM driver but unable to immediately patch, a compensating control is to unload the caam_jr and caam kernel modules using 'modprobe -r caam_jr caam' and blacklist them in /etc/modprobe.d/, then fall back to software cryptography - this eliminates hardware acceleration and may impact performance for cryptographic workloads by 30-70%. Alternatively, if application control is possible, restrict HMAC key lengths to algorithm block size or smaller (64 bytes for SHA-256, 128 bytes for SHA-384/512) to avoid triggering the vulnerable code path, though this is not reliably enforceable at the kernel driver level. Systems not using NXP/Freescale hardware with CAAM support are not affected and do not require action. Verify patch application by checking kernel version with 'uname -r' and confirming it matches or exceeds the fixed versions listed above. Advisory references: https://git.kernel.org/stable/c/cebc5ebd958346195b77f42d0cd5141b4e448fae (mainline fix).

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-28614 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy