PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45937 Linux CVE debrief

A logic error in the Inside Secure EIP-93 cryptographic driver for the Linux kernel causes a kernel panic during driver detach operations. The vulnerability stems from an incorrect iterator in the driver's cleanup routine that attempts to unregister the same hash algorithm multiple times. This double-unregistration triggers a kernel panic, resulting in a denial-of-service condition when the driver is removed or the system undergoes certain shutdown sequences. The issue affects systems utilizing the Inside Secure EIP-93 hardware crypto engine, commonly found in embedded and networking devices. The vulnerability is resolved by correcting the iterator logic to ensure each hash algorithm is unregistered exactly once during driver teardown.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

System administrators and security teams managing Linux systems with Inside Secure EIP-93 hardware cryptographic acceleration, particularly in embedded, networking, and IoT deployments where this hardware is commonly deployed

Technical summary

The Inside Secure EIP-93 cryptographic driver in the Linux kernel contains a bug in its teardown path where an incorrect iterator causes the same hash algorithm to be unregistered multiple times during driver detach. This duplicate unregistration triggers a kernel panic, resulting in system instability or crash. The EIP-93 is a hardware security engine providing cryptographic acceleration; the driver supports multiple hash algorithms. The fix corrects the iterator to ensure proper single unregistration of each algorithm.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable tree commits when available for your distribution
  • Monitor vendor security advisories for updated kernel packages
  • Prioritize patching on systems utilizing Inside Secure EIP-93 hardware cryptographic acceleration
  • Review system logs for kernel panics during driver unload or shutdown operations as potential exploitation indicators
  • Consider disabling EIP-93 driver if cryptographic acceleration is not required as a temporary risk reduction measure

Evidence notes

Vulnerability description confirms kernel panic during driver detach due to incorrect iterator causing duplicate hash algorithm unregistration. Three kernel.org stable tree commits provided as references. CVE published and modified 2026-05-27. No CVSS score or severity assigned; NVD status is 'Awaiting Analysis'. No KEV entry. Vendor identification marked low confidence with review needed.

Official resources

2026-05-27