CVE-2026-64304

Awaiting Analysis Awaiting Analysis - Queue

QAT RSA CRT Component Length Validation Bypass

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size DMA buffers (key_sz / 2) and right-aligns each component with: memcpy(dst + half_key_sz - len, src, len) When a CRT component is larger than half_key_sz the subtraction underflows and memcpy writes past the DMA buffer, causing memory corruption. Add a len > half_key_sz check next to the existing !len check for each of the five CRT components so the driver falls back to the non-CRT path instead of writing out of bounds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64304

EUVD

EUVD-2026-49016

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's crypto module, specifically in the qat driver for RSA key handling. It involves a memory corruption issue where RSA CRT components (p, q, dp, dq, qinv) are incorrectly copied into DMA buffers. When a component's length exceeds half the buffer size, a calculation error causes the data to be written outside the allocated memory, leading to corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem, particularly the qat driver handling RSA CRT components. Detection requires checking kernel logs for memory corruption errors or crashes related to the qat driver. Use commands like dmesg | grep qat or journalctl -k | grep qat to inspect kernel logs for errors.

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or unauthorized access. Systems using the affected qat driver for RSA operations may be at risk if they process maliciously crafted RSA keys.

Compliance Impact

This vulnerability involves memory corruption in the Linux kernel's RSA key handling, specifically in the qat driver. It does not directly relate to data protection or privacy controls required by GDPR or HIPAA. However, if exploited, it could lead to system instability or unauthorized access, potentially compromising systems handling sensitive data.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If an update is not immediately available, disable the qat driver by unloading the module with rmmod qat or blacklisting it in /etc/modprobe.d/. Monitor vendor advisories for patches.

Hi! I’m here to help you understand CVE-2026-64304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70