CVE-2026-93160

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crypto: atmel-ecc - reject hardware ECDH without a public key

The hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the

private key stored in the device. However, the public key is cached only

after atmel_ecdh_set_secret() successfully generated that private key

for the current tfm.

atmel_ecdh_generate_public_key() already rejects requests when no public

key is cached. Add the same check to atmel_ecdh_compute_shared_secret()

to prevent the device from using a private key that was not generated

for the current tfm.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References