Cloudanix VulnDB

CVE-2026-93155

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in error cleanup for encryption setup routines could let a skilled attacker corrupt memory and crash the system.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect array size (ARRAY_SIZE(algs) instead of ARRAY_SIZE(algs_aead)) passed to crypto_engine_unregister_aeads() in the skcipher registration error path, causing the AEAD unregistration helper to iterate over the wrong number of entries and leave a mismatch between registered and unregistered algorithms.

Why it matters to the business

May trigger kernel memory corruption or instability during cryptographic algorithm initialization on Linux systems, leading to crashes or degraded crypto performance in affected environments.

How an attack unfolds

An attacker with local access triggers the specific registration error path by supplying malformed skcipher parameters, causing the mismatched unregistration to corrupt internal crypto state that can be further leveraged for memory manipulation.

How to fix it

Apply the upstream kernel patch that corrects the array size argument and comment; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Inspect the register_aes_algs() function in the keembay crypto driver source to confirm ARRAY_SIZE(algs_aead) is used in the unwind path; verify the fix is present in running kernel builds.

Typical attack path

  1. Cause skcipher registration to fail after AEAD algorithms have been registered
  2. Trigger erroneous AEAD unregistration using the wrong table size
  3. Exploit resulting inconsistent crypto algorithm state for memory corruption

How to detect it

Review kernel logs and dmesg for crypto registration failures or unwind errors; search for unexpected algorithm count mismatches during module load.

What your security team should do

  • Prioritize kernel updates for systems performing crypto operations
  • Monitor kernel logs for registration-related oops or panics
  • Test crypto initialization paths in staging environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Fix AEAD unregister count in error path register_aes_algs() registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registration with crypto_engine_unregister_aeads(), but it passes ARRAY_SIZE(algs), which is the skcipher table size. Use ARRAY_SIZE(algs_aead) for the AEAD unwind path so the unregister helper iterates over the same table that was registered. Also clarify the nearby comment: the crypto registration helpers clean up algorithms registered within the same call, while this function must still unwind earlier successful registration steps.

Affected packages

Ecosystem Package Introduced Fixed