CVE-2026-46291: Linux Kernel CAAM HMAC Key Leakage via Debug Output

Technical summary

The Linux kernel's CAAM crypto driver contained a logic flaw in the hash_digest_key() function where HMAC key material was being logged using standard hex dump routines without conditional guards. When CONFIG_DYNAMIC_DEBUG is enabled, these dumps could expose full key material to kernel logs accessible to unprivileged local users. The fix involves replacing the unrestricted hex dump call with print_hex_dump_devel(), which respects dynamic debug filters and only outputs key material when explicitly requested via dynamic debugging controls, preventing unintended secret leakage at runtime.

Business impact

Organizations running Linux systems with CONFIG_DYNAMIC_DEBUG enabled face potential exposure of HMAC keys used in cryptographic authentication and integrity operations. This could allow attackers with local access to extract keys and forge or modify authenticated messages, undermining the integrity guarantees of systems relying on CAAM-accelerated HMAC operations. The risk is amplified in multi-tenant or shared-kernel environments where attackers gain low-privilege access.

Affected systems

The vulnerability affects Linux kernel implementations that include the CAAM cryptographic driver and are compiled with CONFIG_DYNAMIC_DEBUG enabled. This includes ARM-based systems with CAAM acceleration (common in embedded and IoT devices) and systems where dynamic debugging has been compiled in for development or troubleshooting purposes. The issue does not affect systems where CONFIG_DYNAMIC_DEBUG is disabled or systems not using the CAAM driver.

Exploitability

Exploitation requires local access to the affected system with sufficient privileges to read kernel logs or use dynamic debug controls. The attack surface is limited to users with local login capability or those who can trigger dynamic debug output through sysfs interfaces. Remote exploitation is not feasible. However, in development or staging environments where debug configs are common, the barrier to exploitation is low.

Remediation

Update to a Linux kernel version that includes the fix implementing print_hex_dump_devel() for HMAC key output in hash_digest_key(). Alternatively, disable CONFIG_DYNAMIC_DEBUG at kernel compile time if dynamic debugging is not operationally necessary. Organizations should audit kernel configurations in production systems and remove debug compilation flags unless explicitly required for troubleshooting.

Patch guidance

Verify the specific kernel version your distribution has patched by checking vendor security advisories and release notes. Apply the latest stable kernel update for your distribution (verify against your Linux vendor's CVE advisory pages). If immediate patching is not feasible, mitigate by disabling CONFIG_DYNAMIC_DEBUG and restricting local access to unprivileged user accounts.

Detection guidance

Monitor kernel logs for hex dumps containing key-like patterns, particularly in CAAM-related messages. Check kernel build configurations using 'cat /boot/config-$(uname -r) | grep CONFIG_DYNAMIC_DEBUG' to identify affected systems. Enable security monitoring on /sys/kernel/debug access to detect attempts to trigger debug output. Review system access logs for unauthorized local user activity that could have resulted in log inspection.

Why prioritize this

While the CVSS score is MEDIUM (5.5), the actual risk depends heavily on operational environment. Systems with debug configs enabled warrant immediate patching; production systems with CONFIG_DYNAMIC_DEBUG disabled face minimal risk. Prioritize patching in environments where: (1) local user access exists, (2) CAAM crypto is actively used, and (3) debug configurations are enabled. Defer for systems with hardened configs and restricted local access.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the local-only attack vector, low complexity, and requirement for local privilege escalation context. The vulnerability does not directly crash systems (no availability impact in most scenarios) but enables confidentiality compromise of cryptographic material under specific configuration conditions. The score appropriately captures a moderate risk suitable for standard remediation cycles rather than emergency patching, though context-dependent severity should drive actual prioritization.

Frequently asked questions