CVE-2026-93161
kernel: crypto: qat - clear AES key schedule from stack
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 7, 2026
Description
A flaw was found in the Linux kernel's crypto: qat module. The qat_alg_xts_reverse_key() function expands sensitive Advanced Encryption Standard (AES) key material on the stack. This key material is not properly cleared and can remain in the stack frame, potentially allowing a local attacker to access it. This could lead to the disclosure of cryptographic keys.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer