PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46291 Linux CVE debrief

A vulnerability in the Linux kernel has been resolved. The vulnerability is related to the crypto: caam module, specifically in the hash_digest_key function, where HMAC key bytes were being dumped using print_hex_dump, potentially leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enabled. The fix replaces print_hex_dump with print_hex_dump_devel to prevent this issue.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel who have the crypto: caam module enabled, especially those with CONFIG_DYNAMIC_DEBUG enabled, should be aware of this vulnerability and ensure they are running the patched version of the kernel.

Technical summary

The Linux kernel's crypto: caam module had a vulnerability where HMAC key bytes were being dumped in clear text at runtime when CONFIG_DYNAMIC_DEBUG was enabled. This was fixed by changing print_hex_dump to print_hex_dump_devel in the hash_digest_key function.

Defensive priority

Medium

Recommended defensive actions

  • Update the Linux kernel to a version that includes the fix for CVE-2026-46291.
  • Review kernel configurations to ensure CONFIG_DYNAMIC_DEBUG is not enabled if not necessary.

Evidence notes

The CVE was published and modified on 2026-06-08T17:16:47.357Z. The vulnerability was resolved in the Linux kernel.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46291 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46291

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46291 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46291

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/177730a273b18e195263ed953853273e901b5064

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2adbfca7452eeac45117b8e803288a2767f7075f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5cffe3c136891aa4d579bf5c079a68f7cb371b0c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b8f12d9b00c1950779e5679b9c13908584682bb6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c7e52fe3f7901ccb9cd29b3f7c683d809ba87e48

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.