CVE-2026-64304 Details
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size DMA buffers (key_sz / 2) and right-aligns each component with: memcpy(dst + half_key_sz - len, src, len) When a CRT component is larger than half_key_sz the subtraction underflows and memcpy writes past the DMA buffer, causing memory corruption. Add a len > half_key_sz check next to the existing !len check for each of the five CRT components so the driver falls back to the non-CRT path instead of writing out of bounds.
A vulnerability in the Linux kernel's handling of RSA keys in the QAT (QuickAssist Technology) crypto driver has been identified. The issue arises in the RSA Chinese Remainder Theorem (CRT) key processing, where the driver allocates DMA buffers that are half the size of the key. This buffer size is inadequate for components that exceed half the key length, leading to a subtraction underflow. As a result, the memory copy operation overwrites data outside the allocated buffer, causing memory corruption. The vulnerability affects the Linux kernel's stable group, specifically in versions prior to the latest commit that addresses this issue.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1002719d13072a5e4be1e993aa61dffb4a604e82 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3d61a214fdcda41f1ebfabbb483404032a7b4d91 | kernel.org | Patch |
| https://git.kernel.org/stable/c/500319830d76911c120dc0b9605f8c16d7702844 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6d99c5fadd2df488103f64d6475b63ba6852202b | kernel.org | Patch |
| https://git.kernel.org/stable/c/6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a | kernel.org | Patch |
| https://git.kernel.org/stable/c/b3ac78756588059729b9195fcc9f4b37d54057a5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c34369473bfe92a0b46ec78d6358e30341c7f481 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ce42224487c504aee4b7ff3a7342e7b4d7e28cc9 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.8, < 5.10.261 >= 5.11, < 5.15.212 >= 5.16, < 6.1.178 >= 6.2, < 6.6.145 >= 6.7, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |