CVE-2026-64312

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64312", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.779Z", "datePublished": "2026-07-25T08:49:43.940Z", "dateUpdated": "2026-10-19T20:38:23.127Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:53:12.187Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata. If padata_do_parallel() returns\n-EBUSY, pcrypt falls back to calling the child AEAD directly.\n\nThat fallback must not keep the padata completion callback. Otherwise\nan asynchronous completion runs pcrypt_aead_done() even though the\nrequest was never enrolled in padata.\n\nRestore the original request callback and callback data before calling\nthe child AEAD directly. This keeps the fallback path aligned with a\ndirect AEAD request while leaving the parallel path unchanged."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata->pd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata->pd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/pcrypt.c"], "versions": [{"version": "a92ccd3618e42333ac6f150ecdac14dca298bc7a", "lessThan": "81ce16d938db9b88cdc231522c0358395ae8c6b5", "status": "affected", "versionType": "git"}, {"version": "96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca", "lessThan": "3920c5f6edc341729d20d0507e466c6d3b11f372", "status": "affected", "versionType": "git"}, {"version": "92834692a539b5b7f409e467a14667d64713b732", "lessThan": "ae93c5b3e2a2968b56d772ca1d06615927b7cc36", "status": "affected", "versionType": "git"}, {"version": "5edae7a9a35606017ee6e05911c290acee9fee5a", "lessThan": "82789a44415e3e31168229421b138278dfb16412", "status": "affected", "versionType": "git"}, {"version": "7ddab756f2de5b7b43c122ebebdf37f400fb2b6f", "lessThan": "4711ca06bd169a2cbc9cc59a6de2ed512c41a880", "status": "affected", "versionType": "git"}, {"version": "662f2f13e66d3883b9238b0b96b17886179e60e2", "lessThan": "c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf", "status": "affected", "versionType": "git"}, {"version": "662f2f13e66d3883b9238b0b96b17886179e60e2", "lessThan": "83fa1397d5853de1e27dd52ec44b068ff358ca18", "status": "affected", "versionType": "git"}, {"version": "662f2f13e66d3883b9238b0b96b17886179e60e2", "lessThan": "ed459fe319376e876de433d12b6c6772e612ca36", "status": "affected", "versionType": "git"}, {"version": "dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6", "status": "affected", "versionType": "git"}, {"version": "fca8aed12218f96b38e374ff264d78ea1fbd23cc", "status": "affected", "versionType": "git"}, {"version": "a8e0074ffb38c9a5964a221bb998034d016c93a2", "status": "affected", "versionType": "git"}, {"version": "5.10.231", "lessThan": "5.10.261", "status": "affected", "versionType": "semver"}, {"version": "5.15.174", "lessThan": "5.15.212", "status": "affected", "versionType": "semver"}, {"version": "6.1.120", "lessThan": "6.1.178", "status": "affected", "versionType": "semver"}, {"version": "6.6.64", "lessThan": "6.6.145", "status": "affected", "versionType": "semver"}, {"version": "6.12.2", "lessThan": "6.12.96", "status": "affected", "versionType": "semver"}, {"version": "4.19.325", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.287", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "6.11.11", "lessThan": "6.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/pcrypt.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.231", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.174", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.120", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.64", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.2", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.325"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.287"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5"}, {"url": "https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372"}, {"url": "https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36"}, {"url": "https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412"}, {"url": "https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880"}, {"url": "https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf"}, {"url": "https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18"}, {"url": "https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36"}], "title": "crypto: pcrypt - restore callback for non-parallel fallback", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64312", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:38:50.962318Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-662", "description": "CWE-662 Improper Synchronization"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:38:23.127Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64312", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:38:50.962318Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-662", "description": "CWE-662 Improper Synchronization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:38:51.735Z"}}], "cna": {"title": "crypto: pcrypt - restore callback for non-parallel fallback", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata->pd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata->pd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a92ccd3618e42333ac6f150ecdac14dca298bc7a", "lessThan": "81ce16d938db9b88cdc231522c0358395ae8c6b5", "versionType": "git"}, {"status": "affected", "version": "96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca", "lessThan": "3920c5f6edc341729d20d0507e466c6d3b11f372", "versionType": "git"}, {"status": "affected", "version": "92834692a539b5b7f409e467a14667d64713b732", "lessThan": "ae93c5b3e2a2968b56d772ca1d06615927b7cc36", "versionType": "git"}, {"status": "affected", "version": "5edae7a9a35606017ee6e05911c290acee9fee5a", "lessThan": "82789a44415e3e31168229421b138278dfb16412", "versionType": "git"}, {"status": "affected", "version": "7ddab756f2de5b7b43c122ebebdf37f400fb2b6f", "lessThan": "4711ca06bd169a2cbc9cc59a6de2ed512c41a880", "versionType": "git"}, {"status": "affected", "version": "662f2f13e66d3883b9238b0b96b17886179e60e2", "lessThan": "c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf", "versionType": "git"}, {"status": "affected", "version": "662f2f13e66d3883b9238b0b96b17886179e60e2", "lessThan": "83fa1397d5853de1e27dd52ec44b068ff358ca18", "versionType": "git"}, {"status": "affected", "version": "662f2f13e66d3883b9238b0b96b17886179e60e2", "lessThan": "ed459fe319376e876de433d12b6c6772e612ca36", "versionType": "git"}, {"status": "affected", "version": "dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6", "versionType": "git"}, {"status": "affected", "version": "fca8aed12218f96b38e374ff264d78ea1fbd23cc", "versionType": "git"}, {"status": "affected", "version": "a8e0074ffb38c9a5964a221bb998034d016c93a2", "versionType": "git"}, {"status": "affected", "version": "5.10.231", "lessThan": "5.10.261", "versionType": "semver"}, {"status": "affected", "version": "5.15.174", "lessThan": "5.15.212", "versionType": "semver"}, {"status": "affected", "version": "6.1.120", "lessThan": "6.1.178", "versionType": "semver"}, {"status": "affected", "version": "6.6.64", "lessThan": "6.6.145", "versionType": "semver"}, {"status": "affected", "version": "6.12.2", "lessThan": "6.12.96", "versionType": "semver"}, {"status": "affected", "version": "4.19.325", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.287", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "6.11.11", "lessThan": "6.12", "versionType": "semver"}], "programFiles": ["crypto/pcrypt.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.96", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.39", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["crypto/pcrypt.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5"}, {"url": "https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372"}, {"url": "https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36"}, {"url": "https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412"}, {"url": "https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880"}, {"url": "https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf"}, {"url": "https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18"}, {"url": "https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata. If padata_do_parallel() returns\n-EBUSY, pcrypt falls back to calling the child AEAD directly.\n\nThat fallback must not keep the padata completion callback. Otherwise\nan asynchronous completion runs pcrypt_aead_done() even though the\nrequest was never enrolled in padata.\n\nRestore the original request callback and callback data before calling\nthe child AEAD directly. This keeps the fallback path aligned with a\ndirect AEAD request while leaving the parallel path unchanged."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "5.10.231"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.15.174"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "6.1.120"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "6.6.64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.12.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.325"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.287"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.11.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:53:12.187Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64312", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:38:23.127Z", "dateReserved": "2026-07-19T15:36:31.779Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-25T08:49:43.940Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["crypto/pcrypt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "81ce16d938db9b88cdc231522c0358395ae8c6b5", "status": "affected", "version": "a92ccd3618e42333ac6f150ecdac14dca298bc7a", "versionType": "git"}, {"lessThan": "3920c5f6edc341729d20d0507e466c6d3b11f372", "status": "affected", "version": "96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca", "versionType": "git"}, {"lessThan": "ae93c5b3e2a2968b56d772ca1d06615927b7cc36", "status": "affected", "version": "92834692a539b5b7f409e467a14667d64713b732", "versionType": "git"}, {"lessThan": "82789a44415e3e31168229421b138278dfb16412", "status": "affected", "version": "5edae7a9a35606017ee6e05911c290acee9fee5a", "versionType": "git"}, {"lessThan": "4711ca06bd169a2cbc9cc59a6de2ed512c41a880", "status": "affected", "version": "7ddab756f2de5b7b43c122ebebdf37f400fb2b6f", "versionType": "git"}, {"lessThan": "c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf", "status": "affected", "version": "662f2f13e66d3883b9238b0b96b17886179e60e2", "versionType": "git"}, {"lessThan": "83fa1397d5853de1e27dd52ec44b068ff358ca18", "status": "affected", "version": "662f2f13e66d3883b9238b0b96b17886179e60e2", "versionType": "git"}, {"lessThan": "ed459fe319376e876de433d12b6c6772e612ca36", "status": "affected", "version": "662f2f13e66d3883b9238b0b96b17886179e60e2", "versionType": "git"}, {"status": "affected", "version": "dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6", "versionType": "git"}, {"status": "affected", "version": "fca8aed12218f96b38e374ff264d78ea1fbd23cc", "versionType": "git"}, {"status": "affected", "version": "a8e0074ffb38c9a5964a221bb998034d016c93a2", "versionType": "git"}, {"lessThan": "5.10.261", "status": "affected", "version": "5.10.231", "versionType": "semver"}, {"lessThan": "5.15.212", "status": "affected", "version": "5.15.174", "versionType": "semver"}, {"lessThan": "6.1.178", "status": "affected", "version": "6.1.120", "versionType": "semver"}, {"lessThan": "6.6.145", "status": "affected", "version": "6.6.64", "versionType": "semver"}, {"lessThan": "6.12.96", "status": "affected", "version": "6.12.2", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.325", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.287", "versionType": "semver"}, {"lessThan": "6.12", "status": "affected", "version": "6.11.11", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["crypto/pcrypt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C960EB7-4E90-49E0-BB92-BE6F1B8CF26F", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.325", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E049AFB-F729-4E03-87D4-2BB4FFA5E622", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.287", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C98E5C11-7BF5-4969-8CAF-686C542E5299", "versionEndExcluding": "5.10.261", "versionStartIncluding": "5.10.231", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC79F23E-8949-45EC-ADA0-E703F7261B08", "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.15.174", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6330006E-C961-4B96-B89F-BA284785802A", "versionEndExcluding": "6.1.178", "versionStartIncluding": "6.1.120", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3271AF3-9AD1-42CE-804E-1051350059C2", "versionEndExcluding": "6.6.145", "versionStartIncluding": "6.6.64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CBF5F6E-D446-4CAE-AAA4-413442319824", "versionEndExcluding": "6.12", "versionStartIncluding": "6.11.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E95D4E5-DF4F-446E-8F38-C81ED98D0F0F", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.12.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata. If padata_do_parallel() returns\n-EBUSY, pcrypt falls back to calling the child AEAD directly.\n\nThat fallback must not keep the padata completion callback. Otherwise\nan asynchronous completion runs pcrypt_aead_done() even though the\nrequest was never enrolled in padata.\n\nRestore the original request callback and callback data before calling\nthe child AEAD directly. This keeps the fallback path aligned with a\ndirect AEAD request while leaving the parallel path unchanged."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: pcrypt - restaurar el callback para el mecanismo de reserva no paralelo\n\npcrypt instala pcrypt_aead_done() en la solicitud AEAD hija antes de intentar enviarla a trav\u00e9s de padata. Si padata_do_parallel() devuelve -EBUSY, pcrypt recurre a llamar directamente a la AEAD hija.\n\nEse mecanismo de reserva no debe mantener el callback de finalizaci\u00f3n de padata. De lo contrario, una finalizaci\u00f3n as\u00edncrona ejecuta pcrypt_aead_done() incluso aunque la solicitud nunca fue inscrita en padata.\n\nRestaurar el callback de solicitud original y los datos del callback antes de llamar directamente a la AEAD hija. Esto mantiene la ruta del mecanismo de reserva alineada con una solicitud AEAD directa mientras deja la ruta paralela sin cambios."}], "id": "CVE-2026-64312", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64312", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:38:50.962318Z", "version": "2.0.3"}}]}, "published": "2026-07-25T10:17:12.373", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-662"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: crypto: pcrypt - restore callback for non-parallel fallback", "id": "2507144", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507144"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["A flaw was found in the Linux kernel's parallel cryptography (pcrypt) subsystem. When the system falls back to a non-parallel processing path, it fails to properly restore the original callback function and data. This oversight can lead to an asynchronous completion running an incorrect callback, potentially causing unexpected system behavior or resource management issues. This vulnerability could be exploited by a local attacker to disrupt system operations."], "name": "CVE-2026-64312", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64312\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64312\nhttps://lore.kernel.org/linux-cve-announce/2026072509-CVE-2026-64312-2566@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a92ccd3618e42333ac6f150ecdac14dca298bc7a,81ce16d938db9b88cdc231522c0358395ae8c6b5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca,3920c5f6edc341729d20d0507e466c6d3b11f372)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[92834692a539b5b7f409e467a14667d64713b732,ae93c5b3e2a2968b56d772ca1d06615927b7cc36)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5edae7a9a35606017ee6e05911c290acee9fee5a,82789a44415e3e31168229421b138278dfb16412)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ddab756f2de5b7b43c122ebebdf37f400fb2b6f,4711ca06bd169a2cbc9cc59a6de2ed512c41a880)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[662f2f13e66d3883b9238b0b96b17886179e60e2,c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[662f2f13e66d3883b9238b0b96b17886179e60e2,83fa1397d5853de1e27dd52ec44b068ff358ca18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[662f2f13e66d3883b9238b0b96b17886179e60e2,ed459fe319376e876de433d12b6c6772e612ca36)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "fca8aed12218f96b38e374ff264d78ea1fbd23cc"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "a8e0074ffb38c9a5964a221bb998034d016c93a2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.231,5.10.261)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.174,5.15.212)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.120,6.1.178)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.64,6.6.145)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.2,6.12.96)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.19.325,4.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.287,5.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.11.11,6.12)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T13:15:03.774317+00:00", "updated": "2026-10-23T00:15:13.790644+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}