Medium 5.5Published May 27, 2026

CVE-2026-46019crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup

Updated under an hour ago (Oct 26, 2026, 2:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup atmel_aes_buff_init() allocates 4 pages using __get_free_pages() with ATMEL_AES_BUFFER_ORDER, but atmel_aes_buff_cleanup() frees only the first page using free_page(), leaking the remaining 3 pages. Use free_pages() with ATMEL_AES_BUFFER_ORDER to fix the memory leak.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from bbe628ed897d728d38c4035381d12b2f308fac6f before de6952e0af2acbada900d742437e848285c01d11; from bbe628ed897d728d38c4035381d12b2f308fac6f before 5ad40cde96d603a88d68f8ed59f6d36407ab1f3c; from bbe628ed897d728d38c4035381d12b2f308fac6f before 03e00aafa5f747d07811589e8d5fee638245431b; from bbe628ed897d728d38c4035381d12b2f308fac6f before b63f1e2f0e319ad3fe4a58eb3db4fd50cc98baca; from bbe628ed897d728d38c4035381d12b2f308fac6f before 65b3589d39d05699c3850202f8333e5361033ea3; from bbe628ed897d728d38c4035381d12b2f308fac6f before 61516b4a5b2647dc3f8f67b5dffaf038be997511; from bbe628ed897d728d38c4035381d12b2f308fac6f before 230ad8a78fe67266b1ba4685da1abdd61471c5b8; from bbe628ed897d728d38c4035381d12b2f308fac6f before 3fcfff4ed35f963380a68741bcd52742baff7f76	CNA record
linux linux_kernel linux:linux_kernel	from 4.5 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/de6952e0af2acbada900d742437e848285c01d11	patch
https://git.kernel.org/stable/c/5ad40cde96d603a88d68f8ed59f6d36407ab1f3c	patch
https://git.kernel.org/stable/c/03e00aafa5f747d07811589e8d5fee638245431b	patch
https://git.kernel.org/stable/c/b63f1e2f0e319ad3fe4a58eb3db4fd50cc98baca	patch
https://git.kernel.org/stable/c/65b3589d39d05699c3850202f8333e5361033ea3	patch
https://git.kernel.org/stable/c/61516b4a5b2647dc3f8f67b5dffaf038be997511	patch
https://git.kernel.org/stable/c/230ad8a78fe67266b1ba4685da1abdd61471c5b8	patch
https://git.kernel.org/stable/c/3fcfff4ed35f963380a68741bcd52742baff7f76	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.