Not yet scoredPublished Sep 17, 2026

CVE-2026-93160crypto: atmel-ecc - reject hardware ECDH without a public key

Updated under an hour ago (Oct 27, 2026, 11:10 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-ecc - reject hardware ECDH without a public key The hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the private key stored in the device. However, the public key is cached only after atmel_ecdh_set_secret() successfully generated that private key for the current tfm. atmel_ecdh_generate_public_key() already rejects requests when no public key is cached. Add the same check to atmel_ecdh_compute_shared_secret() to prevent the device from using a private key that was not generated for the current tfm.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	11105693fa05f499532b330da65c78ff93ed4440 builds before 5e33791dfcc6459e402a524669093cd953d5b2df; 11105693fa05f499532b330da65c78ff93ed4440 builds before 33241f198287960bba5fc2251400896762650bfa; 11105693fa05f499532b330da65c78ff93ed4440 builds before 3ea8b780d68f02fe235c5051ce8ac4b4940b9259; 11105693fa05f499532b330da65c78ff93ed4440 builds before 6457162f74f45284ade2da644a4f0c54758ac0a6; 11105693fa05f499532b330da65c78ff93ed4440 builds before 2b40bab362d2b598f34e5ccd4694cedc3c2553d4; from 11105693fa05f499532b330da65c78ff93ed4440 before e64d6f1aae8c837cb3f0446bf44108226d7370f4; from 11105693fa05f499532b330da65c78ff93ed4440 before add28e9988902d29ea93f4869280b4a16a049ea5; from 11105693fa05f499532b330da65c78ff93ed4440 before f240f9b588f4e2de89822adebf560a96b5d263ed	CNA record

References

References

https://git.kernel.org/stable/c/5e33791dfcc6459e402a524669093cd953d5b2df
https://git.kernel.org/stable/c/33241f198287960bba5fc2251400896762650bfa
https://git.kernel.org/stable/c/3ea8b780d68f02fe235c5051ce8ac4b4940b9259
https://git.kernel.org/stable/c/6457162f74f45284ade2da644a4f0c54758ac0a6
https://git.kernel.org/stable/c/2b40bab362d2b598f34e5ccd4694cedc3c2553d4
https://git.kernel.org/stable/c/e64d6f1aae8c837cb3f0446bf44108226d7370f4
https://git.kernel.org/stable/c/add28e9988902d29ea93f4869280b4a16a049ea5
https://git.kernel.org/stable/c/f240f9b588f4e2de89822adebf560a96b5d263ed

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.