CVE-2026-46019 - Vulnerability Details

- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup

atmel_aes_buff_init() allocates 4 pages using __get_free_pages() with
ATMEL_AES_BUFFER_ORDER, but atmel_aes_buff_cleanup() frees only the
first page using free_page(), leaking the remaining 3 pages. Use
free_pages() with ATMEL_AES_BUFFER_ORDER to fix the memory leak.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A kernel driver responsible for the atmel-aes cipher incorrectly releases only one of four allocated pages, leaking three kernel pages per use. The flaw is a heap‑based resource leak (CWE‑763) and can accumulate until physical memory is exhausted, potentially crashing the system or causing a denial of service.

Affected Systems

The issue resides in the Linux kernel’s atmel-aes driver. No specific release range is listed, but any kernel that contains the driver code prior to the corrections in the referenced commits is susceptible.

Risk and Exploitability

The vulnerability could be exploited by local code that repeatedly calls the atmel‑aes functionality, leading to progressive memory exhaustion. The CVSS score is 5.5 and the EPSS score is below 1%, indicating moderate severity and low exploitation probability. The flaw is not listed in the CISA KEV catalog. The most likely attack vector is local execution where the kernel module is available, and the impact is limited to availability through resource depletion.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bbe628ed897d728d38c4035381d12b2f308fac6f`	affected	< de6952e0af2acbada900d742437e848285c01d11
`bbe628ed897d728d38c4035381d12b2f308fac6f`	affected	< 5ad40cde96d603a88d68f8ed59f6d36407ab1f3c
`bbe628ed897d728d38c4035381d12b2f308fac6f`	affected	< 03e00aafa5f747d07811589e8d5fee638245431b
`bbe628ed897d728d38c4035381d12b2f308fac6f`	affected	< b63f1e2f0e319ad3fe4a58eb3db4fd50cc98baca
`bbe628ed897d728d38c4035381d12b2f308fac6f`	affected	< 65b3589d39d05699c3850202f8333e5361033ea3
`bbe628ed897d728d38c4035381d12b2f308fac6f`	affected	< 61516b4a5b2647dc3f8f67b5dffaf038be997511
`bbe628ed897d728d38c4035381d12b2f308fac6f`	affected	< 230ad8a78fe67266b1ba4685da1abdd61471c5b8
`bbe628ed897d728d38c4035381d12b2f308fac6f`	affected	< 3fcfff4ed35f963380a68741bcd52742baff7f76

Linux

affected

Version	Status	Constraints
`4.5`	affected	—
`0`	unaffected	< 4.5
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.140`	unaffected	≤ 6.6.*
`6.12.86`	unaffected	≤ 6.12.*
`6.18.27`	unaffected	≤ 6.18.*
`7.0.4`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bbe628ed897d728d38c4035381d12b2f308fac6f,b63f1e2f0e319ad3fe4a58eb3db4fd50cc98baca)`	affected	code_commit	—
`[bbe628ed897d728d38c4035381d12b2f308fac6f,65b3589d39d05699c3850202f8333e5361033ea3)`	affected	code_commit	—
`[bbe628ed897d728d38c4035381d12b2f308fac6f,61516b4a5b2647dc3f8f67b5dffaf038be997511)`	affected	code_commit	—
`[bbe628ed897d728d38c4035381d12b2f308fac6f,230ad8a78fe67266b1ba4685da1abdd61471c5b8)`	affected	code_commit	—
`[bbe628ed897d728d38c4035381d12b2f308fac6f,3fcfff4ed35f963380a68741bcd52742baff7f76)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.5`	affected	semver	—
`[0,4.5)`	unaffected	semver	—
`[6.6.140,6.7.0)`	unaffected	semver	—
`[6.12.86,6.13.0)`	unaffected	semver	—
`[6.18.27,6.19.0)`	unaffected	semver	—
`[7.0.4,7.1.0)`	unaffected	semver	—
`[7.1-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the atmel‑aes buffer cleanup fix referenced in the advisory commits.
Disable or unload the atmel‑aes driver, especially on systems that cannot be updated immediately, to prevent the exploitation of the memory leak.
Monitor system memory usage and kernel logs for abnormal growth patterns that may indicate repeated usage of the atmel‑aes functionality, and take corrective action if necessary.

Generated by OpenCVE AI on June 17, 2026 at 23:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update
Ubuntu USN	USN-8488-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8489-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8488-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8507-1	Linux kernel (NVIDIA) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00163.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/03e00aafa5f747d07811589e8d5fee638245431b
https://git.kernel.org/stable/c/230ad8a78fe67266b1ba4685da1abdd61471c5b8
https://git.kernel.org/stable/c/3fcfff4ed35f963380a68741bcd52742baff7f76
https://git.kernel.org/stable/c/5ad40cde96d603a88d68f8ed59f6d36407ab1f3c
https://git.kernel.org/stable/c/61516b4a5b2647dc3f8f67b5dffaf038be997511
https://git.kernel.org/stable/c/65b3589d39d05699c3850202f8333e5361033ea3
https://git.kernel.org/stable/c/b63f1e2f0e319ad3fe4a58eb3db4fd50cc98baca
https://git.kernel.org/stable/c/de6952e0af2acbada900d742437e848285c01d11
https://lore.kernel.org/linux-cve-announce/2026052746-CVE-2026-46019-f6e6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46019
https://www.cve.org/CVERecord?id=CVE-2026-46019

History

Tue, 16 Jun 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Mon, 01 Jun 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/03e00aafa5f747d07811589e8d5fee638245431b https://git.kernel.org/stable/c/5ad40cde96d603a88d68f8ed59f6d36407ab1f3c https://git.kernel.org/stable/c/de6952e0af2acbada900d742437e848285c01d11

Thu, 28 May 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-763
References		https://lore.kernel.org/linux-cve-announce/2026052746-CVE-2026-46019-f6e6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46019 https://www.cve.org/CVERecord?id=CVE-2026-46019

Wed, 27 May 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup atmel_aes_buff_init() allocates 4 pages using __get_free_pages() with ATMEL_AES_BUFFER_ORDER, but atmel_aes_buff_cleanup() frees only the first page using free_page(), leaking the remaining 3 pages. Use free_pages() with ATMEL_AES_BUFFER_ORDER to fix the memory leak.
Title		crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/230ad8a78fe67266b1ba4685da1abdd61471c5b8 https://git.kernel.org/stable/c/3fcfff4ed35f963380a68741bcd52742baff7f76 https://git.kernel.org/stable/c/61516b4a5b2647dc3f8f67b5dffaf038be997511 https://git.kernel.org/stable/c/65b3589d39d05699c3850202f8333e5361033ea3 https://git.kernel.org/stable/c/b63f1e2f0e319ad3fe4a58eb3db4fd50cc98baca

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:56:21.100Z

Updated: 2026-06-14T17:48:21.711Z

Reserved: 2026-05-13T15:03:33.092Z

Link: CVE-2026-46019

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-27T14:17:20.353

Modified: 2026-06-17T10:52:54.577

Link: CVE-2026-46019

Redhat

Severity :

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-46019 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-17T23:45:14Z

Weaknesses

CWE-401
Missing Release of Memory after Effective Lifetime
CWE-763
Release of Invalid Pointer or Reference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object