Medium 5.5Published Jun 8, 2026

CVE-2026-46291crypto: caam - guard HMAC key hex dumps in hash_digest_key

Updated under an hour ago (Oct 26, 2026, 5:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: caam - guard HMAC key hex dumps in hash_digest_key Use print_hex_dump_devel() for dumping sensitive HMAC key bytes in hash_digest_key() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 045e36780f11523e26d1e4a8c78bdc57f4003bd0 before e8e72fdf47bd5ef7abe642b034c6178a61a8580a; from 045e36780f11523e26d1e4a8c78bdc57f4003bd0 before cd849c07b8d706425e60a4dfcef54b7b67c967ce; from 045e36780f11523e26d1e4a8c78bdc57f4003bd0 before a9207798fe619cbc85c8744a9b9e2af1db2b6e1a; 045e36780f11523e26d1e4a8c78bdc57f4003bd0 builds before 2adbfca7452eeac45117b8e803288a2767f7075f; from 045e36780f11523e26d1e4a8c78bdc57f4003bd0 before c7e52fe3f7901ccb9cd29b3f7c683d809ba87e48; 045e36780f11523e26d1e4a8c78bdc57f4003bd0 builds before 5cffe3c136891aa4d579bf5c079a68f7cb371b0c; from 045e36780f11523e26d1e4a8c78bdc57f4003bd0 before b8f12d9b00c1950779e5679b9c13908584682bb6; from 045e36780f11523e26d1e4a8c78bdc57f4003bd0 before 177730a273b18e195263ed953853273e901b5064	CNA record
linux linux_kernel linux:linux_kernel	from 3.6 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.140; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7	NVD

References

References

https://git.kernel.org/stable/c/e8e72fdf47bd5ef7abe642b034c6178a61a8580a	patch
https://git.kernel.org/stable/c/cd849c07b8d706425e60a4dfcef54b7b67c967ce	patch
https://git.kernel.org/stable/c/a9207798fe619cbc85c8744a9b9e2af1db2b6e1a	patch
https://git.kernel.org/stable/c/2adbfca7452eeac45117b8e803288a2767f7075f	patch
https://git.kernel.org/stable/c/c7e52fe3f7901ccb9cd29b3f7c683d809ba87e48	patch
https://git.kernel.org/stable/c/5cffe3c136891aa4d579bf5c079a68f7cb371b0c	patch
https://git.kernel.org/stable/c/b8f12d9b00c1950779e5679b9c13908584682bb6	patch
https://git.kernel.org/stable/c/177730a273b18e195263ed953853273e901b5064	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.