CVE-2026-64315 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
crypto: caam - use print_hex_dump_devel to guard key hex dumps
Use print_hex_dump_devel() for dumping sensitive key material in *_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enabled.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability addressed in this linux kernel patch relates to improper handling of cryptographic key material during debugging operations within the caam crypto driver. The issue stems from the use of generic print functions that expose sensitive data when dynamic debug features are enabled, potentially leading to information disclosure attacks. This flaw specifically affects the caam (Cryptographic Acceleration and Memory Management) hardware accelerator driver which provides cryptographic services for various linux systems. When CONFIG_DYNAMIC_DEBUG is enabled in the kernel configuration, certain debugging macros become active and can inadvertently reveal cryptographic keys through hex dump output mechanisms.
The technical implementation flaw occurs in the key setting functions of the caam driver where sensitive cryptographic material is being dumped using standard debug printing routines instead of specialized secure dumping functions. The caam driver implements various cryptographic algorithms including AES, DES, and other symmetric ciphers through hardware acceleration, making it a critical component for system security. When cryptographic keys are processed through *_setkey() functions, the current implementation uses print_hex_dump() or similar functions that do not properly mask sensitive data even when debug output is enabled. This creates an attack surface where adversaries with access to kernel debugging interfaces can extract key material from memory dumps or console output.
The operational impact of this vulnerability extends beyond simple information disclosure as it directly compromises cryptographic security foundations. Attackers could potentially exploit this weakness through various attack vectors including local privilege escalation, memory analysis, or by leveraging systems with dynamic debug enabled for development purposes. The risk is particularly elevated in environments where kernel debugging features remain enabled in production systems or when attackers gain access to system console output. This vulnerability affects any system running linux kernels with the caam driver and dynamic debugging capabilities, potentially compromising encryption keys used for data protection, authentication, and secure communications.
The remediation implemented involves replacing standard hex dump functions with print_hex_dump_devel() which provides enhanced security controls for sensitive data exposure. This change ensures that when CONFIG_DYNAMIC_DEBUG is enabled, cryptographic key material remains protected from accidental disclosure through debug output mechanisms. The solution aligns with security best practices outlined in the common weakness enumeration framework under CWE-200, which addresses information exposure through improper error handling and debugging output. Additionally, this mitigation approach corresponds to techniques described in the attack tactic and technique framework where adversaries attempt to gather sensitive information from system memory and debug interfaces. Organizations should ensure that kernel configurations properly disable dynamic debugging features in production environments and that all cryptographic components follow secure coding practices for sensitive data handling. The patch demonstrates proper security engineering through defensive programming techniques that prevent accidental exposure of secrets even when debugging mechanisms are active, reducing the attack surface for potential information disclosure attacks targeting cryptographic keys.