In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - clear AES key schedule from stack

qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack.
That schedule contains key material and can remain in the stack frame.

Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
5106dfeaeabea73d5132daab1d89d57b57fa98b7 affected < b9cf42622b30178f554fa74411eec67e02d70411
5106dfeaeabea73d5132daab1d89d57b57fa98b7 affected < fb1194b78a163cc56bb9480c707fc34b53522359
5106dfeaeabea73d5132daab1d89d57b57fa98b7 affected < 892f34dc1819cceb8841005a68086710ce3763b6
5106dfeaeabea73d5132daab1d89d57b57fa98b7 affected < dcaa0f1e86cbcb01f68131ae907b54cf299a3592
5106dfeaeabea73d5132daab1d89d57b57fa98b7 affected < 9af019e213ada5c3d0d33c515071a1414b6899f3
5106dfeaeabea73d5132daab1d89d57b57fa98b7 affected < 92e4979e1a770860b26aa3d90cce0c4c6a53833c
5106dfeaeabea73d5132daab1d89d57b57fa98b7 affected < d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9
Linux Linux affected
Version Status Constraints
5.11 affected —
0 unaffected < 5.11
5.15.221 unaffected ≤ 5.15.*
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/892f34dc1819cceb8841005a68086710ce3763b6 cve-icon cve-icon
https://git.kernel.org/stable/c/92e4979e1a770860b26aa3d90cce0c4c6a53833c cve-icon cve-icon
https://git.kernel.org/stable/c/9af019e213ada5c3d0d33c515071a1414b6899f3 cve-icon cve-icon
https://git.kernel.org/stable/c/b9cf42622b30178f554fa74411eec67e02d70411 cve-icon cve-icon
https://git.kernel.org/stable/c/d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9 cve-icon cve-icon
https://git.kernel.org/stable/c/dcaa0f1e86cbcb01f68131ae907b54cf299a3592 cve-icon cve-icon
https://git.kernel.org/stable/c/fb1194b78a163cc56bb9480c707fc34b53522359 cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy.
Title crypto: qat - clear AES key schedule from stack
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:11:55.212Z

Reserved: 2026-09-17T16:02:15.089Z

Link: CVE-2026-93161

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:18:11.533

Modified: 2026-09-17T17:18:11.533

Link: CVE-2026-93161

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.