crypto: atmel-ecc - reject hardware ECDH without a public key
CVE-2026-93160 is fixed in 15 products on 1 platform, first by DEBIAN-CVE-2026-93160, released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.
In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-ecc - reject hardware ECDH without a public key The hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the private key stored in the device. However, the public key is cached only after atmel_ecdh_set_secret() successfully generated that private key for the current tfm. atmel_ecdh_generate_public_key() already rejects requests when no public key is cached. Add the same check to atmel_ecdh_compute_shared_secret() to prevent the device from using a private key that was not generated for the current tfm.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| dtb-aarch64 · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-64kb · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-64kb · sles 16.0 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1 | Nov 7, 2026 |
| kernel-azure · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-azure · sles 16.0 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1 | Nov 7, 2026 |
| kernel-default · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-default · sles 16.0 | 6.12.0-160000.39.1 | SUSE-SU-2026:24197-1 | Nov 7, 2026 |
| kernel-default-base · opensuse-leap 16.0 | 6.12.0-160000.39.1.160000.2.25 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-default-base · sles 16.0 | 6.12.0-160000.39.1.160000.2.26 | SUSE-SU-2026:24235-1 | Nov 7, 2026 |
| kernel-docs · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-docs · sles 16.0 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1 | Nov 7, 2026 |
| kernel-kvmsmall · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-kvmsmall · sles 16.0 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1 | Nov 7, 2026 |
| kernel-obs-build · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-obs-qa · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-obs-qa · sles 16.0 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1 | Nov 7, 2026 |
| kernel-rt · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-source · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-source · sles 16.0 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1 | Nov 7, 2026 |
| kernel-syms · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-syms · sles 16.0 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1 | Nov 7, 2026 |
| kernel-zfcpdump · opensuse-leap 16.0 | 6.12.0-160000.39.1 | OPENSUSE-SU-2026:22091-1 | Nov 7, 2026 |
| kernel-zfcpdump · sles 16.0 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1 | Nov 7, 2026 |
| linux · Debian 12.15 (bookworm) | 6.1.190-1 | DEBIAN-CVE-2026-93160 | Sep 23, 2026 |
| linux · Debian 13.5 (trixie) | 6.12.111-1 | DEBIAN-CVE-2026-93160 | Sep 23, 2026 |
| linux · Debian 14 | 7.2.6-1 | DEBIAN-CVE-2026-93160 | Sep 23, 2026 |
| linux-6.12 · Debian 12.15 (bookworm) | 6.12.111-1~deb12u1 | DEBIAN-CVE-2026-93160 | Sep 23, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.