{"id":"CVE-2026-93161","summary":"crypto: qat - clear AES key schedule from stack","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - clear AES key schedule from stack\n\nqat_alg_xts_reverse_key() expands the forward XTS AES key on the stack.\nThat schedule contains key material and can remain in the stack frame.\n\nClear the temporary crypto_aes_ctx with memzero_explicit() after the copy.","modified":"2026-09-19T03:47:22.773165331Z","published":"2026-09-17T16:11:55.212Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93161.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/892f34dc1819cceb8841005a68086710ce3763b6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/92e4979e1a770860b26aa3d90cce0c4c6a53833c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9af019e213ada5c3d0d33c515071a1414b6899f3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b9cf42622b30178f554fa74411eec67e02d70411"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dcaa0f1e86cbcb01f68131ae907b54cf299a3592"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fb1194b78a163cc56bb9480c707fc34b53522359"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93161.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93161"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5106dfeaeabea73d5132daab1d89d57b57fa98b7"},{"fixed":"b9cf42622b30178f554fa74411eec67e02d70411"},{"fixed":"fb1194b78a163cc56bb9480c707fc34b53522359"},{"fixed":"892f34dc1819cceb8841005a68086710ce3763b6"},{"fixed":"dcaa0f1e86cbcb01f68131ae907b54cf299a3592"},{"fixed":"9af019e213ada5c3d0d33c515071a1414b6899f3"},{"fixed":"92e4979e1a770860b26aa3d90cce0c4c6a53833c"},{"fixed":"d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93161.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93161.json"}}],"schema_version":"1.9.0"}