CVE-2026-45854 Overview
CVE-2026-45854 is a Linux kernel vulnerability in the Inside Secure EIP93 cryptographic driver (crypto: inside-secure/eip93). The driver registers crypto algorithms based on the hardware options register, which indicates which algorithms are implemented in silicon. However, during unregistration, the driver attempts to unregister all algorithms regardless of hardware support. This mismatch causes a kernel panic on platforms where the EIP93 silicon does not implement every possible algorithm. The issue affects systems using the EIP93 crypto engine for hardware-accelerated cryptography.
Critical Impact
Kernel panic occurs on platforms where the EIP93 hardware does not implement all crypto algorithm options, resulting in denial of service during driver unload or module teardown.
Affected Products
- Linux kernel versions containing the inside-secure/eip93 crypto driver
- Platforms using the Inside Secure EIP93 hardware crypto engine
- Embedded systems and SoCs that integrate the EIP93 with a partial algorithm set
Discovery Timeline
- 2026-05-27 - CVE-2026-45854 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45854
Vulnerability Analysis
The EIP93 driver exposes an options register that enumerates which cryptographic algorithms are implemented in silicon. During driver initialization, the driver consults this register and registers only the algorithms backed by hardware. The unregistration path does not perform the same check. It iterates over the full set of algorithms and calls unregister routines for each one, including algorithms that were never registered. On platforms with a partial silicon configuration, this results in operations against stale or uninitialized state and produces a kernel panic.
The defect is a configuration and design flaw in the driver's lifecycle management. It does not require attacker input, but it impacts availability on affected hardware whenever the module is removed or the system tears down crypto resources. The fix aligns the unregister path with the register path so that only algorithms present in the options register are unregistered.
Root Cause
The root cause is an asymmetry between the algorithm registration and unregistration code paths. The register path is conditional on the EIP93 options register. The unregister path is unconditional. Calling crypto_unregister_* for algorithms that were never registered leads to a null pointer dereference or list corruption inside the kernel crypto subsystem, producing a panic.
Attack Vector
This is a local, hardware-dependent reliability issue rather than a remotely exploitable flaw. Triggering the panic requires the EIP93 driver to traverse its unregister path on a platform whose silicon does not implement every algorithm option. Module unload, driver probe failure cleanup, or device teardown can reach this code. No authentication bypass or memory corruption primitive useful for code execution has been described.
No verified exploitation code is available. The vulnerability is described in the upstream kernel changelog and addressed by the patches referenced in the Kernel Patch Commit 0ceeadc, Kernel Patch Commit 243d642, and Kernel Patch Commit 4c1c5a1.
Detection Methods for CVE-2026-45854
Indicators of Compromise
- Kernel panic messages referencing eip93, inside-secure, or crypto_unregister_ symbols in dmesg or serial console logs.
- Crash traces during module unload of the EIP93 driver or during system shutdown on affected hardware.
- Unexpected reboots on embedded platforms that use the EIP93 crypto accelerator.
Detection Strategies
- Inventory kernel versions across Linux fleets and flag systems running EIP93-equipped SoCs with unpatched inside-secure/eip93 drivers.
- Parse /var/log/kern.log and journalctl -k output for panic signatures involving the EIP93 driver.
- Correlate hardware platform identifiers with kernel build versions to scope exposure on embedded and IoT deployments.
Monitoring Recommendations
- Forward kernel logs from Linux endpoints and embedded gateways to a centralized logging platform for crash pattern analysis.
- Alert on repeated kernel panics or watchdog-induced reboots on devices using the EIP93 crypto engine.
- Track modprobe and rmmod activity for the EIP93 driver to identify operations that may trigger the unregister path.
How to Mitigate CVE-2026-45854
Immediate Actions Required
- Apply the upstream stable kernel patches referenced for CVE-2026-45854 to systems using the EIP93 driver.
- Identify embedded and SoC platforms that integrate the Inside Secure EIP93 and prioritize them for kernel updates.
- Avoid unloading the EIP93 driver on unpatched systems until patched kernels are deployed.
Patch Information
The fix updates the EIP93 driver to unregister only those algorithms that were registered based on the options register, restoring symmetry between the register and unregister paths. The patches are available in the upstream stable tree at Kernel Patch Commit 0ceeadc, Kernel Patch Commit 243d642, and Kernel Patch Commit 4c1c5a1. Distribution kernel maintainers should backport these commits into supported branches.
Workarounds
- Blacklist the EIP93 crypto driver on platforms that do not require hardware-accelerated cryptography until patches are applied.
- Restrict administrative access to limit module load and unload operations on affected systems.
- Disable automated driver reload scripts that may trigger the vulnerable unregister path on unpatched kernels.
# Configuration example: prevent loading the EIP93 driver until patched
echo "blacklist crypto_safexcel_eip93" | sudo tee /etc/modprobe.d/blacklist-eip93.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
