CVE-2026-54875: OpenSSL SM2 Timing Side-Channel Vulnerability

CVE-2026-54875 Overview

CVE-2026-54875 is a timing and cache side-channel vulnerability in OpenSSL's SM2 elliptic curve implementation on ARM64 and RISC-V platforms. The optimized scalar point multiplication used for SM2 private key operations is not constant-time. Conditional branches and table lookups depend on the bits of the secret scalar, allowing an attacker who can measure execution time or observe cache-line access patterns to recover information about the SM2 private key or per-signature nonce. The issue is tracked as CWE-208: Observable Timing Discrepancy.

Critical Impact
An attacker with the ability to measure SM2 signing or decryption timing, or to observe cache-access patterns on a co-resident system, can learn information about the secret scalar used during SM2 operations.

Affected Products

OpenSSL 4.0 on ARM64 (AArch64) and RISC-V — fixed in 4.0.3
OpenSSL 3.6, 3.5, and 3.4 on ARM64 and RISC-V — fixed in 3.6.5, 3.5.9, and 3.4.8 respectively
OpenSSL 3.0, 1.1.1, and 1.0.2 are not affected

Discovery Timeline

2 May 2026 - Vulnerability reported by Abhinav Agarwal
6 June 2026 - Independently reported by Feng Xue
2026-09-29 - CVE CVE-2026-54875 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-54875

Vulnerability Analysis

SM2 is a set of elliptic curve cryptographic algorithms standardized in China, providing signature generation, key exchange, and public-key encryption. OpenSSL ships optimized assembly implementations of SM2 scalar multiplication for ARM64 and RISC-V. These optimized routines take control-flow and memory-access decisions based on individual bits of the secret scalar.

Because branches and precomputed-table indices are secret-dependent, the total execution time of a signing or decryption operation and its footprint in the CPU data cache vary with the scalar value. An attacker who repeatedly triggers SM2 operations and measures wall-clock timing, or who runs a co-resident process that probes the shared cache using techniques such as Flush+Reload or Prime+Probe, can extract bits of the long-term private key during decryption or of the per-signature nonce during signing. Recovered nonce bits enable lattice-based reconstruction of the ECDSA-style private key.

The defect does not affect the FIPS module because SM2 is not a FIPS-approved algorithm.

Root Cause

The optimized scalar multiplication routines added for AArch64 and RISC-V use secret-dependent conditional branches and secret-dependent table lookups instead of constant-time selection primitives. Correct constant-time ECC code must access every table entry and use bitmask-based selection so that neither the instruction stream nor the memory access pattern reveals the scalar.

Attack Vector

Exploitation requires the attacker to observe timing or cache behavior of an SM2 signing or decryption operation. Practical scenarios include a co-tenant on a shared virtualization host measuring cache activity, a local unprivileged process monitoring a privileged service, or a network attacker performing high-resolution remote timing analysis against an exposed SM2 endpoint. Attack complexity is high and no authentication or user interaction is required.

No verified public exploitation code is available. Technical details are documented in the OpenSSL Security Advisory 20260929 and the fix commits 3f01bbc, 469f3e4, 9794ed4, and dddad95.

Detection Methods for CVE-2026-54875

Indicators of Compromise

No file-based or network IOCs exist for this side-channel flaw. Successful exploitation leaves no artifacts on the victim host.
Unexpected co-resident processes performing sustained cache-timing measurements against a process that calls OpenSSL SM2 routines may indicate probing.

Detection Strategies

Inventory OpenSSL builds on ARM64 and RISC-V hosts and flag versions in the 3.4.x, 3.5.x, 3.6.x, and 4.0.x branches earlier than the fixed releases.
Identify applications that call EVP_PKEY_sign or EVP_PKEY_decrypt with SM2 keys, including TLS stacks, VPN appliances, and identity services deployed in Chinese-market products.
Review multi-tenant environments where untrusted workloads share physical CPU cache with services performing SM2 operations.

Monitoring Recommendations

Alert on unpatched OpenSSL packages on AArch64 and RISC-V nodes using existing vulnerability management pipelines.
Monitor for unusual perf_event_open usage, high-frequency clflush instructions, or other cache-timing instrumentation from unprivileged processes.
Track process lineage and resource usage around services performing SM2 signing or decryption to spot anomalous neighbors.

How to Mitigate CVE-2026-54875

Immediate Actions Required

Upgrade OpenSSL 4.0 to 4.0.3, 3.6 to 3.6.5, 3.5 to 3.5.9, and 3.4 to 3.4.8 on all ARM64 and RISC-V systems.
Rotate any SM2 long-term private keys that were used on affected platforms in environments where side-channel observation was plausible, such as shared cloud tenants.
Rebuild and redeploy statically linked binaries and container images that bundle a vulnerable OpenSSL.

Patch Information

The fix was developed by Igor Ustinov and replaces the non-constant-time optimized scalar multiplication paths with constant-time equivalents. See the OpenSSL Security Advisory 20260929 and the upstream commits 3f01bbc, 469f3e4, 9794ed4, and dddad95 for the code changes.

Workarounds

Avoid running SM2 signing or decryption workloads on multi-tenant ARM64 or RISC-V hosts until patched builds are deployed.
Where feasible, disable or replace SM2 with a FIPS-approved algorithm such as ECDSA over P-256 for affected services.
Restrict local access on systems performing SM2 operations to reduce the likelihood of co-resident cache probing.

bash

# Verify installed OpenSSL version on affected architectures
uname -m   # expect aarch64 or riscv64
openssl version -a

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade openssl libssl3

# RHEL/Rocky/Alma
sudo dnf upgrade openssl openssl-libs