A vulnerability in the Linux kernel cryptographic driver could lead to the exposure of sensitive key material, posing a risk of unauthorized data access.

The vulnerability exists in the caam (Cryptographic Accelerator and Assurance Module) driver, which improperly handles the logging of sensitive cryptographic keys. An authenticated local attacker with low privileges can exploit this flaw if the kernel is compiled with CONFIG_DYNAMIC_DEBUG enabled, resulting in the exposure of keys in system logs.

The exposure of cryptographic key material is a severe security failure that compromises the confidentiality of encrypted data, potentially allowing for the decryption of sensitive information or the impersonation of secure services. While the CVSS score is 7.0, the potential for widespread data compromise in environments relying on the caam driver warrants an urgent response. Failure to remediate this issue could lead to significant regulatory compliance failures and a total loss of trust in the affected systems.

Immediate Action: Update the Linux kernel to the patched versions: 5.10.261, 5.15.212, 6.1.178, 6.6.145, or newer releases as provided by your distribution vendor.

Proactive Monitoring: Audit system logs for any unexpected output related to the caam driver or cryptographic operations. Disable CONFIG_DYNAMIC_DEBUG in production kernel builds to reduce the attack surface.

Compensating Controls: Restrict access to system logs and sensitive kernel diagnostic interfaces to highly privileged administrators only, ensuring that even if a leak occurs, the visibility of the data is strictly contained.

Public Exploit Available: No

This vulnerability represents a high risk to systems utilizing the caam cryptographic module. Security teams should prioritize patching the kernel to the versions specified in the enrichment data to prevent the inadvertent logging of sensitive cryptographic keys. If an immediate update is not feasible, ensure that kernel debugging features are disabled to mitigate the risk of accidental exposure.