CVE-2026-72151

This vulnerability exposes a design flaw in the kernel crypto API that has silently produced the same use-after-free bug at least three times in the past six years. The KPP functions `crypto_kpp_generate_public_key()` and `crypto_kpp_compute_shared_secret()` return zero for both synchronous success and asynchronous initiation (`-EINPROGRESS`). On systems with synchronous software crypto backends, the code works perfectly — the function completes immediately and returns zero. On systems with asynchronous hardware accelerators (atmel-ecc, HPRE, keembay-ocs), the same call returns zero to signal that a completion worker has been queued. The calling code then frees the request object while the worker still holds a pointer to it. The fix is straightforward: wrap these calls with `crypto_wait_req()`. This pattern already existed in the crypto API toolkit — it was not invented for this patch. The systemic failure is that the crypto subsystem's review process did not treat "discarded return value + immediate object free" as a red flag when the reviewer's test hardware lacked async backends. What makes this CVE particularly concerning is the trigger. The vulnerable path fires automatically from `hwrng_fillfn` during every entropy poll cycle — no user interaction, no syscall boundary, no suspicious ioctl required. On enterprise systems with TPM 2.0 (Dell, HP, Lenovo ship these by default), the kernel continuously exercises this code path in the background. An attacker who corrupts a kernel heap object need only wait for the entropy thread to touch it. The crypto API's silent async/sync polymorphism was a conscious architectural choice made circa 2015-2016, prioritizing driver backward compatibility over developer safety. Compile-time enforcement would require knowing at build time which hardware backends will be present at runtime — a fundamental mismatch with the kernel's loadable module model. The practical remediation is simpler: treat any crypto operation that can return `-EINPROGRESS` as requiring `crypto_wait_req()`, and extend static analysis tooling to flag discarded return values on these functions.

Reviewed through automated stages and approved by a human before publication.