CVE-2026-43336

A flaw was found in the Linux kernel's ChaCha cryptographic algorithm implementation. The permuted_state local variable, which is sufficient to compute the original cryptographic key, was not properly zeroized before leaving its scope. This oversight could allow an attacker to recover the cryptographic key, leading to information disclosure.

The security impact of this flaw is limited because recovering residual cryptographic state from kernel stack memory requires privileged access or an accompanying memory disclosure vulnerability. ChaCha operations in Red Hat Enterprise Linux rely on alternative or architecture-optimized implementations, and the affected generic code is not present in supported kernels. Consequently, enterprise deployments are not exposed to cryptographic key extraction through this vector.