SB2026062959 - NULL pointer dereference in Linux kernel inside-secure eip93 driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-53302)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper algorithm selection in eip93_hmac_setkey() in the EIP93 crypto driver when processing AEAD setkey operations. A local user can trigger a failed setkey operation to cause a denial of service.

A subsequent crypto operation may dereference a NULL pointer in the request context and panic the kernel after the SA record is left partially initialized with zeroed digest fields.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3ba3b02f897b14e34977e1886d95ffe64d907204
• https://git.kernel.org/stable/c/ec226d3e58bb9f0e26a77346085b6b4d594d53d8
• https://git.kernel.org/stable/c/fc9310d79fdb117b369a01eb00f4fd5fb4849d4e