CVE-2026-93160

crypto: atmel-ecc - reject hardware ECDH without a public key

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: atmel-ecc - reject hardware ECDH without a public key

The hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the private key stored in the device. However, the public key is cached only after atmel_ecdh_set_secret() successfully generated that private key for the current tfm.

atmel_ecdh_generate_public_key() already rejects requests when no public key is cached. Add the same check to atmel_ecdh_compute_shared_secret() to prevent the device from using a private key that was not generated for the current tfm.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	11105693fa05f499532b330da65c78ff93ed4440 to before 5e33791dfcc6459e402a524669093cd953d5b2dfAffected 11105693fa05f499532b330da65c78ff93ed4440 to before 33241f198287960bba5fc2251400896762650bfaAffected 11105693fa05f499532b330da65c78ff93ed4440 to before 3ea8b780d68f02fe235c5051ce8ac4b4940b9259Affected 11105693fa05f499532b330da65c78ff93ed4440 to before 6457162f74f45284ade2da644a4f0c54758ac0a6Affected 11105693fa05f499532b330da65c78ff93ed4440 to before 2b40bab362d2b598f34e5ccd4694cedc3c2553d4Affected 11105693fa05f499532b330da65c78ff93ed4440 to before e64d6f1aae8c837cb3f0446bf44108226d7370f4Affected 11105693fa05f499532b330da65c78ff93ed4440 to before add28e9988902d29ea93f4869280b4a16a049ea5Affected 11105693fa05f499532b330da65c78ff93ed4440 to before f240f9b588f4e2de89822adebf560a96b5d263edAffected
LinuxLinux	4.14Affected before 4.14Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

11105693fa05f499532b330da65c78ff93ed4440 to before 5e33791dfcc6459e402a524669093cd953d5b2dfAffected
11105693fa05f499532b330da65c78ff93ed4440 to before 33241f198287960bba5fc2251400896762650bfaAffected
11105693fa05f499532b330da65c78ff93ed4440 to before 3ea8b780d68f02fe235c5051ce8ac4b4940b9259Affected
11105693fa05f499532b330da65c78ff93ed4440 to before 6457162f74f45284ade2da644a4f0c54758ac0a6Affected
11105693fa05f499532b330da65c78ff93ed4440 to before 2b40bab362d2b598f34e5ccd4694cedc3c2553d4Affected
11105693fa05f499532b330da65c78ff93ed4440 to before e64d6f1aae8c837cb3f0446bf44108226d7370f4Affected
11105693fa05f499532b330da65c78ff93ed4440 to before add28e9988902d29ea93f4869280b4a16a049ea5Affected
11105693fa05f499532b330da65c78ff93ed4440 to before f240f9b588f4e2de89822adebf560a96b5d263edAffected

LinuxLinux

4.14Affected
before 4.14Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.