CVE-2026-54875

A flaw was found in OpenSSL. The optimized scalar point multiplication used for SM2 cryptographic operations on ARM64 and RISC-V architectures does not execute in constant time. An attacker capable of measuring execution times or observing processor cache-access patterns can exploit this side channel during decryption or digital signature generation. This vulnerability allows the attacker to deduce sensitive private keys or signature nonces, leading to information disclosure.

Last checked: 2026-10-08 01:48 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 17:17 UTC)

References

• NVD: CVE-2026-54875
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-10-22 06:27 UTC