Key management errors in Linux kernel - CVE-2026-93160
Published: September 18, 2026
Vulnerability identifier: #VU150844
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93160
CWE-ID: CWE-320
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to derive a shared secret using a private key not generated for the current transform context.
The vulnerability exists due to improper cryptographic key management in atmel_ecdh_compute_shared_secret() when processing hardware ECDH shared-secret requests without a cached public key. A local user can submit a hardware ECDH shared-secret request without a cached public key to derive a shared secret using a private key not generated for the current transform context.
Affected software
Linux kernel
How to mitigate CVE-2026-93160
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/2b40bab362d2b598f34e5ccd4694cedc3c2553d4
- https://git.kernel.org/stable/c/33241f198287960bba5fc2251400896762650bfa
- https://git.kernel.org/stable/c/3ea8b780d68f02fe235c5051ce8ac4b4940b9259
- https://git.kernel.org/stable/c/5e33791dfcc6459e402a524669093cd953d5b2df
- https://git.kernel.org/stable/c/6457162f74f45284ade2da644a4f0c54758ac0a6
- https://git.kernel.org/stable/c/add28e9988902d29ea93f4869280b4a16a049ea5
- https://git.kernel.org/stable/c/e64d6f1aae8c837cb3f0446bf44108226d7370f4
- https://git.kernel.org/stable/c/f240f9b588f4e2de89822adebf560a96b5d263ed