CVE-2026-46019: crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
crypto: atmel-aes - Fix 3-page memory leak in atmelaesbuffcleanup
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
Linux kernel crypto: atmel-aesto a version that resolves this vulnerability.Patch Fix 3-page memory leak in atmel_aes_buff_cleanup
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Affected systems are Linux kernel installations using the atmel-aes crypto driver. The provided software list also identifies Microsoft azl3 kernel 6.6.139.1-1.
What conditions are needed to trigger the leak?
The leak occurs when atmel_aes_buff_init() allocates its four-page buffer and atmel_aes_buff_cleanup() later releases it. Cleanup frees only the first page, leaving three pages allocated.
What is the operational impact?
Each affected allocation-and-cleanup cycle leaks three memory pages. Repeated triggering can consume memory and cause an availability impact.
What is the remediation?
Apply a kernel update containing the fix that replaces the single-page free_page() cleanup with free_pages() using ATMEL_AES_BUFFER_ORDER.