CVE-2026-45900 Overview
CVE-2026-45900 is a memory leak vulnerability in the Linux kernel's Cryptographic Accelerator and Assurance Module (CAAM) driver, specifically within the dpaa2_caam_probe() function. The flaw originates from incomplete cleanup logic introduced by commit 0e1a4d427f58 ("crypto: caam: Unembed net_dev structure in dpaa2"), which converted embedded net_device structures to dynamically allocated pointers. While cleanup was added to dpaa2_dpseci_disable(), the corresponding cleanup in dpaa2_dpseci_free() for error paths was omitted. Failed probe attempts leak allocated netdev memory each time the deferred probe retry mechanism is triggered.
Critical Impact
Repeated failed probe attempts of the DPAA2 CAAM crypto driver leak kernel memory associated with netdev allocations, leading to gradual kernel memory exhaustion on affected systems.
Affected Products
- Linux kernel versions containing commit 0e1a4d427f58 introducing the unembedded net_device structure in the DPAA2 CAAM driver
- Systems using NXP DPAA2 (Data Path Acceleration Architecture v2) hardware with the CAAM crypto accelerator
- Linux distributions shipping affected stable kernel branches prior to the fix commits
Discovery Timeline
- 2026-05-27 - CVE CVE-2026-45900 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45900
Vulnerability Analysis
The vulnerability resides in the DPAA2 CAAM crypto driver, which handles cryptographic offloading on NXP DPAA2-based platforms. The driver allocates per-CPU net_device structures during initialization through dpaa2_caam_probe(). When dpaa2_dpseci_dpio_setup() fails — commonly because Data Path I/O (DPIO) devices are not yet ready — the probe routine returns an error and the kernel's deferred probe mechanism schedules a retry.
The cleanup path invoked on this failure, dpaa2_dpseci_free(), does not release the dynamically allocated netdevs. Each retry cycle allocates a fresh set of netdev structures without freeing those allocated during the previous failed attempt. Kernel memory leak detection (kmemleak) reports multiple leaked netdev-related allocations traceable to dpaa2_caam_probe().
Root Cause
The defect is an incomplete refactor in commit 0e1a4d427f58. When the embedded net_device was converted to a dynamically allocated pointer, the author added matching free_netdev() cleanup in dpaa2_dpseci_disable() (the runtime teardown path) but did not add equivalent cleanup in dpaa2_dpseci_free() (the error path during probe). This is classified as a Memory Leak [CWE-401] within the kernel driver subsystem.
Attack Vector
The vulnerability is not directly exploitable as a remote or local attack primitive. It manifests as a resource exhaustion condition on hardware platforms where the DPAA2 CAAM driver repeatedly defers probing. Systems with long boot sequences, transient DPIO unavailability, or module reload loops accumulate leaked memory over time. The leak is limited to kernel boot or driver initialization paths and does not provide code execution.
The upstream fix preserves the CPU mask of netdevs allocated during setup and iterates that mask in dpaa2_dpseci_free() to release each previously allocated netdev. Using the stored CPU mask rather than the current online mask avoids inconsistencies when CPU hotplug events change the topology between allocation and cleanup. See the Linux kernel stable commit for the implementation.
Detection Methods for CVE-2026-45900
Indicators of Compromise
- kmemleak reports referencing dpaa2_caam_probe() in the allocation backtrace
- Repeated EPROBE_DEFER messages from the DPAA2 CAAM driver in dmesg output
- Growing kernel Slab memory consumption observable through /proc/meminfo on DPAA2-based systems
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK on test or staging kernels and scan /sys/kernel/debug/kmemleak for entries containing dpaa2_caam or alloc_netdev_mqs frames
- Inventory deployed kernel versions against the patched stable commits to identify hosts still running vulnerable code
- Monitor kernel ring buffer messages for crypto driver probe deferral patterns during system startup
Monitoring Recommendations
- Track per-host kernel slab memory growth over time and alert on sustained increases without corresponding workload changes
- Collect dmesg output and stable kernel version strings as part of standard endpoint telemetry for fleet-wide review
- Validate that NXP DPAA2 hardware platforms receive timely stable kernel updates as part of the patch management cadence
How to Mitigate CVE-2026-45900
Immediate Actions Required
- Apply the upstream Linux kernel stable patches referenced in the NVD advisory to all systems running the DPAA2 CAAM driver
- Identify hosts with NXP DPAA2 hardware in the asset inventory and prioritize them for patch rollout
- Reboot affected systems after patching to clear any accumulated leaked kernel memory
Patch Information
The fix is available in multiple stable kernel branches through the following commits: 7d43252b3060, d5c6f254528c, d7decb572b55, and e144cce29851. The patch records the CPU mask of allocated netdevs during setup and uses that mask to free them in dpaa2_dpseci_free().
Workarounds
- Disable the DPAA2 CAAM driver (CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM) on systems that do not require hardware crypto offload, then rebuild the kernel
- Avoid repeated module unload and reload cycles of dpaa2_caam on unpatched kernels to limit leak accumulation
- Schedule periodic reboots on affected hosts until patches can be applied, releasing leaked kernel memory back to the system
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
