CVE-2026-43330

A moderate-severity out-of-bounds read flaw was found in the Linux kernel's CAAM (Cryptographic Accelerator and Assurance Module) driver. When an HMAC key longer than the hash block size is set, the driver copies the key into a buffer sized to the DMA cache alignment using kmemdup, which reads (aligned_len - keylen) bytes beyond the end of the keylen-sized source buffer. The over-read data is hashed back into the real key, which can expose adjacent kernel memory and corrupt neighbouring memory, resulting in system instability or denial of service. Exploitation requires local access to a system equipped with the CAAM cryptographic accelerator whose algorithms are in use, so a local process able to reach the kernel crypto setkey path can trigger the flaw. This flaw affects the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2, where fixes are being pursued through the respective delegated maintenance streams. Earlier Red Hat Enterprise Linux versions (RHEL 6, 7, 8, and 9, including kernel-rt) are not affected because the vulnerable code is not present in those kernels. Although the upstream CVSS 3.1 score is 7.8 (IMPORTANT), Red Hat rates this flaw as MODERATE because it is not network reachable, requires local access on hardware with the CAAM accelerator, and the primary impact is denial of service.