CVE-2026-43330

A flaw was found in the Linux kernel's caam cryptographic accelerator driver. When processing a Hash-based Message Authentication Code (HMAC) key that exceeds the block size, the driver incorrectly handles memory allocation and copying. This can lead to an overflow, where the system attempts to read beyond the intended memory buffer, potentially corrupting neighboring memory. This memory corruption could lead to system instability or denial of service.

A moderate-severity out-of-bounds read flaw was found in the Linux kernel's CAAM (Cryptographic Accelerator and Assurance Module) driver. When an HMAC key longer than the hash block size is set, the driver copies the key into a buffer sized to the DMA cache alignment using kmemdup, which reads (aligned_len - keylen) bytes beyond the end of the keylen-sized source buffer. The over-read data is hashed back into the real key, which can expose adjacent kernel memory and corrupt neighbouring memory, resulting in system instability or denial of service. Exploitation requires local access to a system equipped with the CAAM cryptographic accelerator whose algorithms are in use, so a local process able to reach the kernel crypto setkey path can trigger the flaw. This flaw affects the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2, where fixes are being pursued through the respective delegated maintenance streams. Earlier Red Hat Enterprise Linux versions (RHEL 6, 7, 8, and 9, including kernel-rt) are not affected because the vulnerable code is not present in those kernels. Although the upstream CVSS 3.1 score is 7.8 (IMPORTANT), Red Hat rates this flaw as MODERATE because it is not network reachable, requires local access on hardware with the CAAM accelerator, and the primary impact is denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.