Inclusion of Sensitive Information in Log Files in Linux kernel - CVE-2026-64315
Published: July 27, 2026
Vulnerability identifier: #VU139669
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64315
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into log files in the caam crypto driver setkey handlers when dumping key material during key setup with dynamic debug enabled. A local user can access debug output containing sensitive key material to disclose sensitive information.
Exposure occurs at runtime when CONFIG_DYNAMIC_DEBUG is enabled.
Affected software
Linux kernel
How to mitigate CVE-2026-64315
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/1ec775f6a124cce6278ae58b7d1c78a3bc6eef23
- https://git.kernel.org/stable/c/59057f5d4e9a195c6dd61695ad3bc4481ddf4f14
- https://git.kernel.org/stable/c/6407dc85d0a4306681cf6c9be7f05e05dcb67a37
- https://git.kernel.org/stable/c/8005dc808bcce7d6cc2ae015a3cde1683bee602d
- https://git.kernel.org/stable/c/8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7
- https://git.kernel.org/stable/c/bcf3cf74dfb6981e18b22cbf561f859a0f7faa26
- https://git.kernel.org/stable/c/c8cfe11e48b2a4646fa662fcaa92e14810a28d46
- https://git.kernel.org/stable/c/d0b8cafd529b4ec759190c6081f7a76efb563a8f