CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps
In the Linux kernel, the following vulnerability has been resolved:
crypto: caam - use printhexdumpdevel to guard key hex dumps
Use printhexdumpdevel() for dumping sensitive key material in setkey() to avoid leaking secrets at runtime when CONFIGDYNAMICDEBUG is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure key hex dumps in crypto: caam are guarded by using print_hex_dump_devel() when CONFIG_DYNAMIC_DEBUG is enabled (apply the change described: "Use print_hex_dump_devel() for dumping sensitive key material").
Linux kernel crypto: caam CONFIG_DYNAMIC_DEBUG = enabled
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Exposure is local: the CVSS vector requires local access and low privileges. Exploitation is rated high complexity and does not require user interaction.
Under what configuration can sensitive material be exposed?
The issue concerns CAAM key-setting paths that dump sensitive key material when CONFIG_DYNAMIC_DEBUG is enabled. Systems not using the affected CAAM functionality or without dynamic debug enabled are not described as exposed by the supplied information.
What can be done before a fix is deployed?
Avoid enabling CONFIG_DYNAMIC_DEBUG in environments using CAAM key-setting operations, because the leak occurs through runtime key hex dumps under that configuration. Apply the available stable-kernel fix when possible.