CVE-2026-93160

What it actually does

The missing validation in atmel_ecdh_compute_shared_secret() allowed the hardware ECDH operation to proceed using a private key that was not generated for the current transformation context, bypassing the public-key cache check present in the generate path.

Why it matters to the business

Organizations relying on Atmel ECC hardware for Linux-based cryptographic operations faced risk of incorrect shared-secret generation, potentially weakening key exchange in TLS, VPNs, or device authentication and leading to compliance or operational issues until kernels are updated.

How an attack unfolds

An attacker with local or network access to trigger ECDH operations on an affected Atmel-equipped system could cause the driver to compute a shared secret with a mismatched or stale private key, resulting in cryptographic material that does not correspond to the intended peer public key.

How to fix it

Update to a Linux kernel containing the fix that adds the public-key cache check inside atmel_ecdh_compute_shared_secret(); rebuild and deploy the updated kernel on all affected systems; disable the atmel-ecc hardware offload if an immediate update is not feasible.

How to confirm the fix worked

Confirm the presence of the cache check in atmel_ecdh_compute_shared_secret() by inspecting the driver source or running a test that exercises set_secret followed directly by compute_shared_secret and verifies rejection; verify the running kernel version against the fixed upstream commit.

Typical attack path

1. Identify a system using the atmel-ecc driver for ECDH key exchange
2. Trigger or observe calls to atmel_ecdh_set_secret followed by compute_shared_secret without an intervening generate_public_key for the same tfm
3. Force the hardware to produce a shared secret derived from an unintended private key
4. Use the resulting weak or incorrect secret to decrypt, impersonate, or bypass authentication

How to detect it

Review kernel logs for atmel-ecc driver errors or unexpected successful ECDH computations after set_secret without generate_public_key; correlate with process activity performing key exchanges on affected hardware; look for post-fix kernel builds in package managers or build artifacts.

What your security team should do

• Prioritize kernel updates on any systems exposing Atmel ECC hardware
• Audit cryptographic libraries and applications that may select the atmel_ecdh implementation
• Add kernel version checks to vulnerability scanning and asset inventory
• Monitor upstream stable branches for backports of the fix