CVE-2026-93161 crypto: qat - clear AES key schedule from stack
An attacker with local access could potentially read sensitive AES key material from the kernel stack due to insufficient memory clearing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93161?
CVE-2026-93161 is a vulnerability in Linux, published on 17 Sep 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - clear AES key schedule from stack
qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame.
Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy.
Which versions are affected by CVE-2026-93161?
How do I fix CVE-2026-93161?
Apply the vendor's patch.
Is CVE-2026-93161 being exploited?
There is no known exploitation of CVE-2026-93161 in the wild and no public exploit code.
Sources
Also known as AZL-102084, BELL-CVE-2026-93161, DEBIAN-CVE-2026-93161, GHSA-jc96-xj7h-vxxp, UBUNTU-CVE-2026-93161.