CVE-2026-82390

The Espressif AES driver drivers/crypto/cryptoesp32aes.c advertises a multi-session cipher API — it hands out up to CONFIGESP32CRYPTOAESSESSIONSMAX default 4 independent sessions, each carrying its own key and direction. The AES peripheral, however, has a single chip-global set of key and mode...

CVE-2026-82390 Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver

The Espressif AES driver drivers/crypto/cryptoesp32aes.c advertises a multi-session cipher API — it hands out up to CONFIGESP32CRYPTOAESSESSIONSMAX default 4 independent sessions, each carrying its own key and direction. The AES peripheral, however, has a single chip-global set of key and mode...

CVE-2026-82390

The Espressif AES driver (drivers/crypto/crypto_esp32_aes.c) contains a cross-session AES key confusion vulnerability. The driver provides a multi-session API, but the underlying hardware uses a single set of global registers for keys and modes. Because aes_begin_session() programs these register...

EUVD-2026-109976

The Espressif AES driver drivers/crypto/cryptoesp32aes.c advertises a multi-session cipher API — it hands out up to CONFIGESP32CRYPTOAESSESSIONSMAX default 4 independent sessions, each carrying its own key and direction. The AES peripheral, however, has a single chip-global set of key and mode...