Sensitive Information in Resource Not Removed Before Reuse in Linux kernel - CVE-2026-80708
Published: August 28, 2026
Vulnerability identifier: #VU146072
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80708
CWE-ID: CWE-226
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper clearing of sensitive information in _ip_cprb_helper() and cca_clr2cipherkey() when processing clear key import requests. A local user can trigger clear key import operations and expose residual clear key material from reused memory to disclose sensitive information.
The issue affects internal CPRB buffer memory as well as the random EXOR buffer used during the clear key to secure key token import process.
Affected software
Linux kernel
How to mitigate CVE-2026-80708
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/01476391aecef36a3b789ee844357b22fbc90665
- https://git.kernel.org/stable/c/4e26d0d72bfdec311f12acfa0c6b7fbeb6a343d3
- https://git.kernel.org/stable/c/7dd6e556dbfc91d3d511cfd1015d2dad42608010
- https://git.kernel.org/stable/c/8e1c0def77b7450be0ed607ed0d7bae629d30020
- https://git.kernel.org/stable/c/b453003ae6a869f5bdf025b5519cbb38295ae4f1
- https://git.kernel.org/stable/c/be7ae07fb745d1cf575b03a178a055b0a2859364
- https://git.kernel.org/stable/c/ebfbb9ac7adbb1e3556100b54a27e8a9b102feac
- https://git.kernel.org/stable/c/fbb0410986e8ad214121e51a4a28c3d0a10b7644