PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45937 Linux CVE debrief

A logic error in the Inside Secure EIP-93 cryptographic driver for the Linux kernel causes a kernel panic during driver detach operations. The vulnerability stems from an incorrect iterator in the driver's cleanup routine that attempts to unregister the same hash algorithm multiple times. This double-unregistration triggers a kernel panic, resulting in a denial-of-service condition when the driver is removed or the system undergoes certain shutdown sequences. The issue affects systems utilizing the Inside Secure EIP-93 hardware crypto engine, commonly found in embedded and networking devices. The vulnerability is resolved by correcting the iterator logic to ensure each hash algorithm is unregistered exactly once during driver teardown.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

System administrators and security teams managing Linux systems with Inside Secure EIP-93 hardware cryptographic acceleration, particularly in embedded, networking, and IoT deployments where this hardware is commonly deployed

Technical summary

The Inside Secure EIP-93 cryptographic driver in the Linux kernel contains a bug in its teardown path where an incorrect iterator causes the same hash algorithm to be unregistered multiple times during driver detach. This duplicate unregistration triggers a kernel panic, resulting in system instability or crash. The EIP-93 is a hardware security engine providing cryptographic acceleration; the driver supports multiple hash algorithms. The fix corrects the iterator to ensure proper single unregistration of each algorithm.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable tree commits when available for your distribution
  • Monitor vendor security advisories for updated kernel packages
  • Prioritize patching on systems utilizing Inside Secure EIP-93 hardware cryptographic acceleration
  • Review system logs for kernel panics during driver unload or shutdown operations as potential exploitation indicators
  • Consider disabling EIP-93 driver if cryptographic acceleration is not required as a temporary risk reduction measure

Evidence notes

Vulnerability description confirms kernel panic during driver detach due to incorrect iterator causing duplicate hash algorithm unregistration. Three kernel.org stable tree commits provided as references. CVE published and modified 2026-05-27. No CVSS score or severity assigned; NVD status is 'Awaiting Analysis'. No KEV entry. Vendor identification marked low confidence with review needed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45937 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45937

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45937 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45937

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7530c3595d1e23bc5938cbd44b7e8f33457fc71f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/91c6f25075a8f8fbd7316d73e1edf281a94f78df

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b6e32ba6d32503440a3e3e16c8d0521cbb7e0c5d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.