CVE-2026-64315: Linux Kernel Information Disclosure Flaw

CVE-2026-64315 Overview

CVE-2026-64315 is an information disclosure vulnerability in the Linux kernel's Cryptographic Accelerator and Assurance Module (CAAM) crypto driver. The flaw resides in the *_setkey() functions, which use unguarded hex dump routines to log key material. When CONFIG_DYNAMIC_DEBUG is enabled at runtime, the driver can leak sensitive cryptographic key bytes to the kernel log. The fix replaces print_hex_dump_debug() with print_hex_dump_devel() so the dumps are only compiled in during development builds.

Critical Impact
A local, low-privileged user with access to kernel log output can recover cryptographic secrets processed by the CAAM driver, undermining the confidentiality and integrity of protected data.

Affected Products

Linux kernel builds shipping the drivers/crypto/caam subsystem with CONFIG_DYNAMIC_DEBUG enabled
Distributions and embedded platforms that rely on NXP CAAM hardware crypto acceleration
Multiple stable kernel branches, as indicated by the eight backport commits published on git.kernel.org

Discovery Timeline

2026-07-25 - CVE-2026-64315 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64315

Vulnerability Analysis

The CAAM driver in drivers/crypto/caam implements hardware-accelerated cryptographic operations for NXP System-on-Chip (SoC) platforms. Each transform (AEAD, AHASH, SKCIPHER) registers a setkey callback that stores caller-supplied key material inside driver state. For debugging purposes, several of these callbacks call print_hex_dump_debug() on the raw key buffer.

print_hex_dump_debug() is controlled by CONFIG_DYNAMIC_DEBUG. When that option is enabled, an operator can toggle the dump at runtime via debugfs or the dyndbg kernel command line, causing the raw key bytes to be written to the kernel ring buffer. Any process able to read dmesg or /var/log/kern.log can then recover the secret. This is a classic sensitive information exposure through log files [CWE-532] combined with insertion of sensitive information into log files [CWE-117].

Root Cause

The root cause is the use of a debug macro that survives production builds. print_hex_dump_debug() compiles into a runtime-toggleable call, so the sensitive dump remains reachable even in shipped kernels. The remediation switches to print_hex_dump_devel(), which is compiled out unless DEBUG is defined for the translation unit, ensuring the key material never reaches the log buffer in release configurations.

Attack Vector

Exploitation requires local access and the ability to trigger CAAM setkey operations, for example by using kernel crypto APIs through AF_ALG or IPsec. The attacker then reads the resulting kernel log entries. No user interaction is needed. The high attack complexity reflects the requirement that CONFIG_DYNAMIC_DEBUG is enabled and that the specific dynamic debug site is activated. No verified public exploit code is available for CVE-2026-64315.

Detection Methods for CVE-2026-64315

Indicators of Compromise

Kernel ring buffer entries originating from CAAM setkey paths containing hexadecimal byte sequences that match cryptographic key lengths (16, 24, 32, or 64 bytes).
dyndbg control writes to /sys/kernel/debug/dynamic_debug/control that enable debug lines within drivers/crypto/caam/*.c.
Non-root processes reading /dev/kmsg, dmesg, or persistent kernel log files on systems that use CAAM acceleration.

Detection Strategies

Audit kernel configuration for CONFIG_DYNAMIC_DEBUG=y combined with unpatched CAAM sources.
Inspect journald and syslog collectors for hex-dump patterns tagged with caam module prefixes.
Correlate crypto API usage (AF_ALG socket creation, IPsec SA installation) with subsequent large hex dumps in kern.log.

Monitoring Recommendations

Forward kernel logs to a centralized platform and alert on caam.*setkey messages that contain long hex byte runs.
Track processes that open /dev/kmsg or invoke dmesg outside of expected administrative workflows.
Baseline dynamic debug control file writes and alert on changes on production hosts.

How to Mitigate CVE-2026-64315

Immediate Actions Required

Apply the upstream stable kernel updates that switch CAAM setkey dumps to print_hex_dump_devel().
Restrict access to kernel logs by enforcing dmesg_restrict=1 and tightening permissions on log files.
Disable CONFIG_DYNAMIC_DEBUG on production builds where runtime debug output is not required.

Patch Information

The fix is distributed across eight upstream commits covering mainline and stable branches: 1ec775f6, 59057f5d, 6407dc85, 8005dc80, 8904b425, bcf3cf74, c8cfe11e, and d0b8cafd. Refer to the Linux Kernel Commit 1ec775f, Linux Kernel Commit 59057f, Linux Kernel Commit 6407dc, Linux Kernel Commit 8005dc, Linux Kernel Commit 8904b, Linux Kernel Commit bcf3cf, Linux Kernel Commit c8cfe1, and Linux Kernel Commit d0b8ca for backport selection guidance.

Workarounds

Set kernel.dmesg_restrict=1 via sysctl to prevent non-privileged users from reading the kernel ring buffer.
Rebuild the CAAM driver with DEBUG undefined and remove any custom dyndbg entries targeting drivers/crypto/caam.
Where CAAM acceleration is not required, blacklist the caam module to eliminate the vulnerable code path entirely.

bash

# Configuration example
sudo sysctl -w kernel.dmesg_restrict=1
echo 'kernel.dmesg_restrict=1' | sudo tee /etc/sysctl.d/99-kmsg.conf
echo 'module drivers/crypto/caam -p' | sudo tee /sys/kernel/debug/dynamic_debug/control