The CAAM crypto driver in the Linux kernel, when CONFIG_DYNAMIC_DEBUG is enabled, can emit hex dumps of cryptographic key material during key–setting operations. This accidental disclosure occurs without providing additional controls, allowing someone who can read kernel logs or debug output to recover sensitive keys. The weakness is classified as Information Exposure (CWE-215).

Any Linux kernel build that includes the CAAM crypto module with CONFIG_DYNAMIC_DEBUG active is potentially vulnerable. The flaw applies to all kernel versions released before the patch was integrated, so any older kernel may still expose keys when dynamic debugging is enabled.

The CVSS score of 7 indicates high severity of information disclosure. The EPSS score is less than 1%, implying a very low probability of exploitation in the current landscape, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to enable or read kernel debug logs, typically requiring local or privileged access. Because the leak only occurs when dynamic debugging is enabled, widespread exploitation is unlikely under normal operating conditions.