SB2026091852 - Sensitive Information in Resource Not Removed Before Reuse in Linux kernel qat qat_common driver
Published: September 18, 2026
Security Bulletin ID
SB2026091852
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-93161)
CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive key material.
The vulnerability exists due to failure to clear sensitive information from stack memory in qat_alg_xts_reverse_key() when expanding a forward XTS AES key. A local user can access residual AES key material in stack memory to disclose sensitive key material.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/892f34dc1819cceb8841005a68086710ce3763b6
- https://git.kernel.org/stable/c/92e4979e1a770860b26aa3d90cce0c4c6a53833c
- https://git.kernel.org/stable/c/9af019e213ada5c3d0d33c515071a1414b6899f3
- https://git.kernel.org/stable/c/b9cf42622b30178f554fa74411eec67e02d70411
- https://git.kernel.org/stable/c/d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9
- https://git.kernel.org/stable/c/dcaa0f1e86cbcb01f68131ae907b54cf299a3592
- https://git.kernel.org/stable/c/fb1194b78a163cc56bb9480c707fc34b53522359