LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46077: crypto: atmel-tdes - fix DMA sync direction

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-tdes - fix DMA sync direction Before DMA output is consumed by the CPU, ->dma_addr_out must be synced with dma_sync_single_for_cpu() instead of dma_sync_single_for_device(). Using the wrong direction can return stale cache data on non-coherent platforms.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver flaw in the Atmel TDES crypto path. On certain non-coherent hardware, encrypted or decrypted output may be read from stale CPU cache instead of fresh DMA output. The sources do not provide CVSS, confirmed impact scope, or active exploitation evidence.

Executive priority

Track and remediate through normal kernel maintenance unless your environment uses Atmel TDES acceleration on embedded or non-coherent platforms. Escalate priority if those systems protect sensitive cryptographic workflows or safety-critical operations.

Technical view

The atmel-tdes driver synchronized dma_addr_out with dma_sync_single_for_device() before CPU consumption. The fix changes the direction to dma_sync_single_for_cpu(), preventing stale cache data on non-coherent platforms. Evidence is limited to the CVE record and Linux stable commits.

Likely exposure

Exposure appears limited to Linux systems using the Atmel TDES crypto driver on non-coherent platforms and running affected kernel builds. General Linux servers without this driver or hardware path are less likely to be exposed, but distro backports must be checked.

Exploitation context

The source bundle marks KEV as false and cites no active exploitation. It does not describe a practical attack path, prerequisites, or remote exploitability. Treat this as a correctness and data-integrity risk until vendor advisories clarify severity.

Researcher notes

The core issue is incorrect DMA synchronization direction before CPU reads output data. The CVE lacks CVSS, CWE, exploit detail, and vendor-specific fixed-package mapping. Validate impact empirically through code review and platform inventory rather than assuming broad Linux exposure.

Mitigation direction

  • Check vendor or distribution kernel advisories for backported fixes.
  • Update affected Linux kernels when a fixed package is available.
  • Prioritize systems using Atmel TDES hardware acceleration on non-coherent platforms.
  • Consider disabling unused Atmel TDES driver support where operationally safe.

Validation and detection

  • Inventory kernels and hardware that load or build the atmel-tdes driver.
  • Compare deployed kernel packages against vendor fixed versions or patches.
  • Review distribution changelogs for the referenced upstream stable commits.
  • Confirm non-coherent platform exposure with platform and kernel configuration owners.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46077 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux13802005d8f2db244ec1f5d7f6923de8f7a463db, 13802005d8f2db244ec1f5d7f6923de8f7a463db, 13802005d8f2db244ec1f5d7f6923de8f7a463db, 13802005d8f2db244ec1f5d7f6923de8f7a463db, 13802005d8f2db244ec1f5d7f6923de8f7a463db, 13802005d8f2db244ec1f5d7f6923de8f7a463db, 13802005d8f2db244ec1f5d7f6923de8f7a463db, 13802005d8f2db244ec1f5d7f6923de8f7a463dbunaffected
LinuxLinux3.6, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.