The Linux kernel's crypto CAAM subsystem had a vulnerability (CVE-2026-43044) where supplying an HMAC key longer than the block size caused a copied key to be allocated without proper DMA cache alignment. Although rounding for alignment was calculated, it was not used in the allocation, which could lead to DMA corruption of neighboring memory. The fix replaces the kmemdup allocation with kmalloc for a larger buffer followed by memcpy to ensure proper alignment and prevent memory corruption. This vulnerability affects multiple Linux kernel versions prior to 6.8.0 and its variants. The issue has been patched as part of a broader Linux kernel security update addressing numerous vulnerabilities. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector with low complexity and no user interaction, resulting in high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability could cause corruption of memory adjacent to the allocated buffer during DMA operations in the crypto CAAM driver. This may lead to compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.8 reflects a high severity impact. However, exploitation requires local access with low privileges and no user interaction.

An official patch is available and should be applied promptly to affected Linux kernel versions. The vulnerability is fixed by updating to Linux kernel versions 6.8.0 and later or the corresponding patched builds. After applying the update, a system reboot is required to complete remediation. Due to an ABI change in the kernel update, third-party kernel modules must be recompiled and reinstalled. Follow the vendor advisory instructions for updating and rebuilding kernel modules. No additional mitigations are specified beyond applying the official fix.