🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-46291 is a vulnerability in the Linux kernel’s CAAM (Cryptographic Acceleration and Assurance Module) driver, specifically affecting how HMAC key material is handled during hash digest key operations. The flaw can expose sensitive cryptographic key data through unguarded hex dumps, potentially leaking HMAC secrets into kernel logs or debug output. This matters because HMAC keys exposed in this way could undermine the integrity and authenticity guarantees of cryptographic operations running on affected systems, including those hosted in Azure environments using Linux-based virtual machines.
Security Architect’s Take: Review your Azure Linux VM and AKS node configurations to ensure kernel debug logging and crash dump access is restricted to authorised personnel, and prioritise patching the Linux kernel to a version that includes this fix. Additionally, audit any workloads relying on kernel-level HMAC operations for secrets management to assess exposure risk.
Original advisory: CVE-2026-46291 crypto: caam - guard HMAC key hex dumps in hash_digest_key