A bug in the Linux kernel’s caam crypto module caused the hash_digest_key() function to call print_hex_dump_devel() on HMAC key bytes when CONFIG_DYNAMIC_DEBUG is enabled. This produced hexadecimal dumps of secret keys into kernel logs, exposing cryptographic material to anyone who could read those logs. The vulnerability represents a classic information‑disclosure flaw, as it allows an attacker to retrieve data that should remain confidential.

The issue affects Linux kernel builds that include the caam crypto module and compile with dynamic debugging enabled. Since the CVE entry does not specify a version range, any kernel with this configuration may be vulnerable until the upstream patch is applied.

The CVSS score of 5.5 indicates a moderate severity. The likely attack vector is a privileged local user with read access to kernel logs or debug output, as the vulnerability leaks HMAC key bytes via print_hex_dump_devel() when CONFIG_DYNAMIC_DEBUG is enabled; this inference is based on the description. While no EPSS score is available and the CVE is not listed in the CISA KEV catalog, no public exploits exist, the flaw can be exploited locally by such users, and remote exploitation is unlikely unless debug logs are exposed externally. Therefore, the attack surface remains limited to privileged or local users.