CVE-2026-46291: Linux Kernel Information Disclosure Bug

CVE-2026-46291 Overview

CVE-2026-46291 affects the Linux kernel's Cryptographic Accelerator and Assurance Module (CAAM) driver. The flaw resides in the hash_digest_key() function, which previously used an unguarded hex dump routine to log Hash-based Message Authentication Code (HMAC) key material. When CONFIG_DYNAMIC_DEBUG is enabled at runtime, sensitive HMAC key bytes can be written to kernel log buffers. The upstream fix replaces the call with print_hex_dump_devel(), restricting the disclosure to debug builds. This is an information disclosure issue classified under sensitive data exposure.

Critical Impact
Local users with access to kernel log facilities can recover HMAC secret key material when dynamic debug logging is enabled in the CAAM crypto driver.

Affected Products

Linux kernel — drivers/crypto/caam (CAAM hardware crypto driver)
Linux kernel builds with CONFIG_DYNAMIC_DEBUG enabled
Systems using NXP/Freescale CAAM hardware acceleration for HMAC operations

Discovery Timeline

2026-06-08 - CVE-2026-46291 published to the National Vulnerability Database
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46291

Vulnerability Analysis

The Linux CAAM driver provides hardware-accelerated cryptographic operations on NXP i.MX and QorIQ platforms. Within hash_digest_key(), the driver processes HMAC keys that exceed the underlying hash block size by hashing them down to a fixed length. Prior to the fix, the function invoked print_hex_dump() against the raw key buffer during debug tracing. Because print_hex_dump() emits output regardless of debug build state when CONFIG_DYNAMIC_DEBUG is active, secret HMAC key bytes can be persisted to dmesg and the kernel ring buffer. Any local user or process with read access to kernel log facilities can then recover the key material and forge authenticated messages or impersonate cryptographic identities.

Root Cause

The root cause is improper output guarding of sensitive cryptographic material in a debug logging path. The original code path called the general-purpose hex dump helper, which does not honor build-time debug gating. The fix in the upstream commits replaces it with print_hex_dump_devel(), a variant that only emits output in developer debug builds, ensuring HMAC key bytes are not exposed in production kernels even when dynamic debug is otherwise active.

Attack Vector

Exploitation requires local access to a system that is using the CAAM driver for HMAC operations with CONFIG_DYNAMIC_DEBUG enabled and dynamic debug activated for the affected file. An attacker reads the kernel log via dmesg, /dev/kmsg, or /var/log/kern.log to recover the disclosed HMAC key material. The vulnerability does not permit code execution or memory corruption; it is strictly an information disclosure flaw in the cryptographic logging path. Remote exploitation is not feasible without an additional primitive that exposes kernel log contents.

No public proof-of-concept code is associated with this issue. The patch is described in the upstream kernel commits referenced below.

Detection Methods for CVE-2026-46291

Indicators of Compromise

Kernel log entries originating from the caam subsystem that contain hex-encoded byte sequences associated with HMAC key dumps.
Presence of dynamic debug control entries enabling verbose logging in caamhash.c or related CAAM source files via /sys/kernel/debug/dynamic_debug/control.
Unexpected reads of /dev/kmsg or dmesg by unprivileged or service accounts on platforms using CAAM hardware crypto.

Detection Strategies

Audit kernel build configurations for CONFIG_DYNAMIC_DEBUG=y combined with active CAAM driver usage.
Inspect the running dynamic debug control file to confirm whether CAAM hash routines have logging enabled.
Correlate process access to kernel log interfaces with low-privilege user identities to detect reconnaissance against disclosed key material.

Monitoring Recommendations

Forward kern.log and journal entries to a centralized log platform and alert on hex dump patterns sourced from caam modules.
Track changes to /sys/kernel/debug/dynamic_debug/control through file integrity monitoring.
Monitor for installation of unsigned or out-of-tree CAAM drivers on production hosts.

How to Mitigate CVE-2026-46291

Immediate Actions Required

Apply the upstream stable kernel updates that replace print_hex_dump() with print_hex_dump_devel() in hash_digest_key().
Disable dynamic debug entries for the CAAM hash driver until patched kernels are deployed.
Restrict access to dmesg and /dev/kmsg by setting kernel.dmesg_restrict=1 to limit exposure of any logged key material.

Patch Information

The fix is available in the upstream Linux stable trees. See the patch commits: Kernel commit 177730a2, Kernel commit 2adbfca7, Kernel commit 5cffe3c1, Kernel commit b8f12d9b, and Kernel commit c7e52fe3. Distribution-supplied kernel updates should be installed once available.

Workarounds

Rebuild the kernel without CONFIG_DYNAMIC_DEBUG on production systems that use CAAM hardware crypto.
Ensure dynamic debug for CAAM hash code paths is not enabled by clearing matching entries in /sys/kernel/debug/dynamic_debug/control.
Apply kernel.dmesg_restrict=1 and tighten permissions on kernel log files to prevent unprivileged disclosure.

bash

# Configuration example
# Restrict kernel log access
sysctl -w kernel.dmesg_restrict=1
echo 'kernel.dmesg_restrict=1' >> /etc/sysctl.d/99-hardening.conf

# Disable dynamic debug entries for the CAAM hash driver
echo 'file drivers/crypto/caam/caamhash.c -p' > /sys/kernel/debug/dynamic_debug/control