CVE-2026-46077: Linux Kernel Privilege Escalation Flaw

CVE-2026-46077 Overview

CVE-2026-46077 affects the Linux kernel's atmel-tdes crypto driver, which provides Triple DES (TDES) hardware acceleration on Atmel-based platforms. The driver uses the wrong DMA synchronization direction when handling output buffers. Specifically, ->dma_addr_out is synced with dma_sync_single_for_device() before the CPU consumes the DMA output, instead of dma_sync_single_for_cpu(). On non-coherent platforms, this incorrect ordering returns stale cache data to callers of the crypto API. The result is corrupted ciphertext or plaintext returned to kernel consumers that depend on TDES operations.

Critical Impact
Crypto API consumers on non-coherent Atmel systems can receive stale cached data, undermining the correctness and integrity guarantees of TDES operations.

Affected Products

Linux kernel branches containing the atmel-tdes driver prior to the fix commits
Atmel SoC platforms relying on the TDES hardware crypto engine
Non-coherent ARM platforms using kernel crypto API via atmel-tdes

Discovery Timeline

2026-05-27 - CVE-2026-46077 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46077

Vulnerability Analysis

The Linux kernel DMA API requires drivers to explicitly transfer cache ownership between the CPU and the device. dma_sync_single_for_device() flushes CPU caches and hands the buffer to the device. dma_sync_single_for_cpu() invalidates CPU caches so that the CPU sees data written by the device. The atmel-tdes driver inverted this sequence for the output buffer (->dma_addr_out). After the TDES engine wrote the result to memory, the driver called the device-side sync routine rather than the CPU-side sync routine. On platforms without hardware cache coherency, the CPU then read stale data from its cache, never observing the bytes the engine had written. Consumers of the crypto API received unreliable TDES output, breaking confidentiality and integrity assumptions for any subsystem layered on top.

Root Cause

The root cause is an incorrect DMA direction barrier in the atmel-tdes driver. The fix replaces dma_sync_single_for_device() with dma_sync_single_for_cpu() on the output path so the CPU sees device-written bytes after the TDES operation completes.

Attack Vector

This is a correctness defect rather than a directly exploitable memory-safety bug. The flaw is triggered by normal use of the TDES engine on non-coherent Atmel platforms. Any kernel path that requests TDES through the crypto API can return stale cipher output, which downstream code may treat as valid cryptographic data.

The vulnerability is a cache coherence and DMA synchronization issue. No verified exploit code is published. See the upstream patches in the Kernel Git Commit 12a0adf and related backports for technical details.

Detection Methods for CVE-2026-46077

Indicators of Compromise

Intermittent TDES decryption or encryption failures reported by kernel crypto consumers on Atmel hardware
Crypto self-test (tcrypt) failures specific to tdes-atmel algorithm names
Data integrity mismatches in disk, network, or filesystem subsystems that rely on TDES

Detection Strategies

Audit running kernel versions on Atmel-based devices and compare against the fix commits listed in the kernel.org references
Run kernel crypto self-tests after boot on affected hardware to detect stale-data symptoms
Inspect dmesg for atmel-tdes initialization messages combined with non-coherent DMA platform markers

Monitoring Recommendations

Track kernel package versions across embedded Atmel fleets and alert on unpatched builds
Centralize kernel logs and crypto subsystem errors for correlation across devices
Monitor application-layer integrity check failures that could indicate corrupted TDES output

How to Mitigate CVE-2026-46077

Immediate Actions Required

Upgrade the Linux kernel to a stable release that includes the atmel-tdes DMA sync fix
Inventory Atmel platforms using the in-tree TDES driver and prioritize patching non-coherent systems
Validate crypto consumers after patching by running kernel tcrypt and application-level checks

Patch Information

The issue is resolved by replacing dma_sync_single_for_device() with dma_sync_single_for_cpu() on the output buffer in drivers/crypto/atmel-tdes.c. Fixes are available in the following stable backports: Kernel Git Commit 12a0adf, Kernel Git Commit 5281e6e, Kernel Git Commit 863d11b, Kernel Git Commit b5f5df8, and Kernel Git Commit c8a9a64.

Workarounds

Disable the atmel-tdes driver and fall back to software TDES via the generic kernel crypto implementation
Avoid TDES in user-space and kernel consumers on affected hardware until the patch is applied
Where feasible, migrate to modern algorithms such as AES that do not depend on the atmel-tdes code path

bash

# Blacklist the atmel-tdes driver until the kernel is patched
echo "blacklist atmel_tdes" | sudo tee /etc/modprobe.d/blacklist-atmel-tdes.conf
sudo update-initramfs -u
sudo reboot