CVE-2026-45986: Linux Kernel Memory Leak Vulnerability

CVE-2026-45986 Overview

CVE-2026-45986 is a memory leak vulnerability in the Linux kernel's ccree cryptographic driver. The flaw resides in the cc_mac_digest() function, which fails to release mapped resources when cc_map_hash_request_final() returns an error. Each failed invocation leaks kernel memory that was allocated for the hash request mapping. The upstream kernel fix adds a call to cc_unmap_result() along the error path to release the previously mapped result buffer. The issue affects systems using the ARM TrustZone CryptoCell (ccree) hardware crypto accelerator driver.

Critical Impact
Repeated triggering of the failure path can exhaust kernel memory on affected systems, leading to degraded performance or denial of service.

Affected Products

Linux kernel — drivers/crypto/ccree subsystem
Stable kernel branches receiving the referenced backports
Systems using ARM TrustZone CryptoCell (ccree) hardware crypto offload

Discovery Timeline

2026-05-27 - CVE-2026-45986 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45986

Vulnerability Analysis

The ccree driver provides kernel-side support for ARM's CryptoCell hardware crypto engine. Within this driver, cc_mac_digest() orchestrates a Message Authentication Code (MAC) digest operation. As part of setup, it invokes cc_map_hash_request_final() to map DMA-accessible buffers for the request, including the result buffer.

When cc_map_hash_request_final() succeeds but a later step fails, the driver must release the mapped buffers. Prior to the fix, the error handling in cc_mac_digest() did not call cc_unmap_result() when the subsequent operations failed. The mapped result buffer was never released, producing a kernel memory leak each time the failure path executed. This corresponds to a Memory Leak weakness.

Root Cause

The root cause is incomplete cleanup along an error path. The function allocates and maps resources but does not symmetrically unmap them when downstream calls return an error. The patch adds the missing cc_unmap_result() call to restore correct lifetime management of the mapped result buffer.

Attack Vector

The vulnerability is reachable only by code paths that submit MAC digest requests through the ccree driver. To accumulate measurable leakage, an attacker or workload must repeatedly trigger the failure condition inside cc_map_hash_request_final(). Sustained triggering can exhaust kernel memory and destabilize the system. There is no indication of remote exploitation or code execution.

No verified public exploitation code is available. Technical details are documented in the upstream patches referenced below:

Detection Methods for CVE-2026-45986

Indicators of Compromise

Steady growth of kernel slab memory attributable to crypto request allocations without a matching workload increase.
Increasing failure counters or error messages originating from the ccree driver and cc_map_hash_request_final().
System instability or out-of-memory conditions on hosts that perform frequent MAC digest operations via CryptoCell hardware.

Detection Strategies

Compare installed kernel versions against the fixed stable branches listed in the upstream commits referenced above.
Monitor /proc/slabinfo and kmemleak reports for unbounded growth tied to crypto request structures.
Review dmesg for repeated ccree mapping failures, which indicate the vulnerable code path is being exercised.

Monitoring Recommendations

Track long-term trends of kernel memory consumption on systems using the ccree driver.
Alert on abnormal rates of MAC digest API failures from userspace cryptographic consumers.
Correlate kernel memory growth with workload telemetry to distinguish leaks from legitimate demand.

How to Mitigate CVE-2026-45986

Immediate Actions Required

Identify Linux systems that load the ccree kernel module, typically ARM-based platforms with CryptoCell hardware.
Apply the latest stable kernel update from your distribution that includes the upstream fix adding cc_unmap_result() to cc_mac_digest().
Reboot affected systems after patching to load the corrected kernel image.

Patch Information

The upstream fix adds a call to cc_unmap_result() on the error path of cc_mac_digest() when cc_map_hash_request_final() fails. Backports are available across multiple stable branches via the kernel.org commits 02c64052fad0, 22f1dd4ca3bf, 3061c9bfb3f5, 502440c235fe, and 910f335786a0. Consume the fix through your distribution's kernel update channel.

Workarounds

If patching cannot be performed immediately, restrict workloads that submit large volumes of MAC digest requests through the ccree driver.
Where hardware-accelerated MAC is not required, disable or unload the ccree module and use software crypto implementations.
Schedule periodic reboots to reset accumulated kernel memory leakage until the fixed kernel is deployed.

bash

# Verify whether the ccree driver is loaded
lsmod | grep ccree

# Check current kernel version against distribution advisories
uname -r

# Apply distribution kernel updates (example: Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)
sudo reboot