CVE-2026-93161 PUBLISHED

crypto: qat - clear AES key schedule from stack

Assigner: Linux
Reserved: 17.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - clear AES key schedule from stack

qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame.

Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 to b9cf42622b30178f554fa74411eec67e02d70411 (excl.)
  • affected from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 to fb1194b78a163cc56bb9480c707fc34b53522359 (excl.)
  • affected from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 to 892f34dc1819cceb8841005a68086710ce3763b6 (excl.)
  • affected from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 to dcaa0f1e86cbcb01f68131ae907b54cf299a3592 (excl.)
  • affected from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 to 9af019e213ada5c3d0d33c515071a1414b6899f3 (excl.)
  • affected from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 to 92e4979e1a770860b26aa3d90cce0c4c6a53833c (excl.)
  • affected from 5106dfeaeabea73d5132daab1d89d57b57fa98b7 to d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.11 is affected
  • unaffected from 0 to 5.11 (excl.)
  • unaffected from 5.15.221 to 5.15.* (incl.)
  • unaffected from 6.1.188 to 6.1.* (incl.)
  • unaffected from 6.6.157 to 6.6.* (incl.)
  • unaffected from 6.12.110 to 6.12.* (incl.)
  • unaffected from 6.18.52 to 6.18.* (incl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References