CVE-2026-64316: Linux Kernel Information Disclosure Flaw

CVE-2026-64316 Overview

CVE-2026-64316 is an information disclosure vulnerability in the Linux kernel's Cryptographic Acceleration and Assurance Module (CAAM) driver. The flaw exists in the *_setkey() and gen_split_key() functions, which used unconditional hex dumps of sensitive key material. When CONFIG_DYNAMIC_DEBUG is enabled, these dumps could leak cryptographic secrets into kernel log output at runtime. The upstream fix replaces the calls with print_hex_dump_devel(), which is compiled out unless debug builds explicitly require it.

Critical Impact
Cryptographic key material handled by the CAAM driver could be exposed through kernel debug logs on systems with dynamic debug enabled, undermining the confidentiality of hardware-accelerated crypto operations.

Affected Products

Linux kernel builds including the Freescale/NXP CAAM crypto driver
Kernel configurations with CONFIG_DYNAMIC_DEBUG enabled
Downstream distributions shipping affected stable kernel branches prior to backport of the fix

Discovery Timeline

2026-07-25 - CVE-2026-64316 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64316

Vulnerability Analysis

The CAAM driver in drivers/crypto/caam/ provides hardware-accelerated cryptographic operations on NXP/Freescale SoCs. During key installation, the driver invoked print_hex_dump_debug() on raw key buffers in the *_setkey() callbacks and inside gen_split_key(). These helpers are intended for developer diagnostics, but when kernel builds enable CONFIG_DYNAMIC_DEBUG, the dump statements can be toggled on at runtime through /sys/kernel/debug/dynamic_debug/control without recompilation. Any privileged user or process able to enable those pr_debug sites could observe raw symmetric keys and split-key material in dmesg or the kernel ring buffer.

This is an information disclosure issue [CWE-532: Insertion of Sensitive Information into Log File] rather than a memory corruption bug. The fix substitutes print_hex_dump_devel(), a variant that is only compiled in when explicit developer debug flags are set, preventing secret material from ever reaching runtime logs on production kernels.

Root Cause

The root cause is the use of a debug-print primitive that respects runtime toggles rather than compile-time guards. The developers assumed hex dumps of key buffers would remain inert on production systems, but CONFIG_DYNAMIC_DEBUG promotes these statements to runtime-controllable log sites.

Attack Vector

Exploitation requires local access with sufficient privileges to toggle dynamic debug entries and read kernel logs, typically CAP_SYS_ADMIN or root. Once enabled, subsequent setkey operations by any user of the CAAM crypto API cause key bytes to be written to the kernel log, where they can be harvested by an attacker with log access.

See the upstream commits for the exact code changes across affected stable branches, including commit 3f57657b6ea2 and commit ebd37eef6e4f.

Detection Methods for CVE-2026-64316

Indicators of Compromise

Kernel ring buffer or journalctl -k output containing hex dumps originating from caam_jr, caamalg, or gen_split_key call sites.
Non-empty entries under /sys/kernel/debug/dynamic_debug/control that reference CAAM source files with the flag p (print) enabled.
Unexpected write access to /sys/kernel/debug/dynamic_debug/control from non-administrative processes.

Detection Strategies

Audit running kernels for CONFIG_DYNAMIC_DEBUG=y combined with the CAAM driver loaded (lsmod | grep caam).
Inspect dmesg on affected hardware for hex-dump patterns adjacent to cryptographic operations.
Monitor debugfs mount points and restrict access to the dynamic debug interface.

Monitoring Recommendations

Forward kernel logs to a centralized log store and alert on hex-dump signatures within CAAM-related messages.
Track kernel package versions across the fleet and flag hosts running kernel builds prior to the backported fix.
Alert on writes to /sys/kernel/debug/dynamic_debug/control outside of approved change windows.

How to Mitigate CVE-2026-64316

Immediate Actions Required

Apply the stable kernel updates that incorporate the print_hex_dump_devel() fix on all systems running the CAAM driver.
Restrict access to debugfs and the dynamic debug control interface to root-only, and mount debugfs with strict permissions or leave it unmounted on production hosts.
Rotate any CAAM-managed keys that may have been dumped while dynamic debug was active.

Patch Information

The fix is available in the upstream Linux kernel via multiple stable-branch commits, including 3f57657b6ea2, 45c0e3615e5b, 6f7b8e0321f3, 8b56ba10105c, 8cf5fb050312, 9a53dc0a0ae0, cea7302d5d05, and ebd37eef6e4f. Refer to the kernel.org stable commit index and update to the corresponding stable release for your branch.

Workarounds

Build kernels with CONFIG_DYNAMIC_DEBUG=n where feasible until patched kernels are deployed.
Unmount or restrict debugfs so that dynamic debug prints cannot be enabled at runtime.
Purge existing kernel logs that may contain leaked key material and enforce log access controls.

bash

# Restrict debugfs and confirm no CAAM debug prints are active
mount -o remount,mode=700 /sys/kernel/debug 2>/dev/null || umount /sys/kernel/debug
grep -R "caam" /sys/kernel/debug/dynamic_debug/control | grep ' p '
uname -r  # verify kernel includes the stable backport