Linux Kernel EUVD-2026-28620

This vulnerability affects the ChaCha stream cipher implementation in lib/crypto/chacha.c, specifically the permutation function used in kernel cryptographic operations. ChaCha20 is a widely-deployed stream cipher used for encryption and as a cryptographic building block in the kernel's random number generator. The cipher operates through a reversible permutation function that transforms an initial state (containing the key) into a pseudorandom output. The vulnerability stems from a stack hygiene issue: after the permutation completes, the intermediate 'permuted_state' variable remains on the stack without explicit memory sanitization. Because ChaCha's permutation is mathematically invertible, an attacker with the ability to read kernel stack memory could reverse the permutation to recover the original state, including the encryption key. While the kernel generally attempts to zeroize sensitive stack data as a defense-in-depth measure (though not consistently), this particular location was missed. The fix introduced explicit memzero_explicit() calls to sanitize the stack variable before function return. This affects all kernel versions since ChaCha was introduced in 4.2 (commit c08d0e647305c3f8f640010a56c9e4bafb9488d3).