CVE-2026-93160 crypto: atmel-ecc - reject hardware ECDH without a public key
The Linux kernel Atmel ECC driver failed to validate public key presence, potentially allowing incorrect cryptographic operations using stale private keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93160?
CVE-2026-93160 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: atmel-ecc - reject hardware ECDH without a public key
The hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the private key stored in the device. However, the public key is cached only after atmel_ecdh_set_secret() successfully generated that private key for the current tfm.
atmel_ecdh_generate_public_key() already rejects requests when no public key is cached. Add the same check to atmel_ecdh_compute_shared_secret() to prevent the device from using a private key that was not generated for the current tfm.
Which versions are affected by CVE-2026-93160?
How do I fix CVE-2026-93160?
Apply the vendor's patch.
Is CVE-2026-93160 being exploited?
There is no known exploitation of CVE-2026-93160 in the wild and no public exploit code.
Sources
Also known as AZL-102192, BELL-CVE-2026-93160, DEBIAN-CVE-2026-93160, GHSA-qjm8-c6rq-8r66, UBUNTU-CVE-2026-93160.