Answer in brief
CVE-2026-93161 records a Unknown severity vulnerability in crypto: qat - clear AES key schedule from stack. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=5106dfeaeabea73d5132daab1d89d57b57fa98b7 <b9cf42622b30178f554fa74411eec67e02d70411 || >=5106dfeaeabea73d5132daab1d89d57b57fa98b7 <fb1194b78a163cc56bb9480c707fc34b53522359 || >=5106dfeaeabea73d5132daab1d89d57b57fa98b7 <892f34dc1819cceb8841005a68086710ce3763b6 || >=5106dfeaeabea73d5132daab1d89d57b57fa98b7 <dcaa0f1e86cbcb01f68131ae907b54cf299a3592 || >=5106dfeaeabea73d5132daab1d89d57b57fa98b7 <9af019e213ada5c3d0d33c515071a1414b6899f3 || >=5106dfeaeabea73d5132daab1d89d57b57fa98b7 <92e4979e1a770860b26aa3d90cce0c4c6a53833c || >=5106dfeaeabea73d5132daab1d89d57b57fa98b7 <d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9 | b9cf42622b30178f554fa74411eec67e02d70411, fb1194b78a163cc56bb9480c707fc34b53522359, 892f34dc1819cceb8841005a68086710ce3763b6, dcaa0f1e86cbcb01f68131ae907b54cf299a3592, 9af019e213ada5c3d0d33c515071a1414b6899f3, 92e4979e1a770860b26aa3d90cce0c4c6a53833c, d41a9fcfb7f9ee36e4a4aaf5e7996bca6be1e7a9 |
| Linux/Linuxgeneric | 5.11 | Not reported |
Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 17, 2026
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy.
Quoted source text, attributed separately from HOL analysis.