CVE-2026-64314
Received Received - Intake

Kernel Panic in Linux Crypto API ChaCha20-Poly1305 Implementation

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: chacha20poly1305 - validate poly1305 template argument chachapoly_create() still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediately passes it to strcmp(). When the argument is missing, crypto_attr_alg_name() returns an error pointer. Check for that before comparing the name so malformed template instantiations fail with an error instead of dereferencing the error pointer in strcmp(). This matches the surrounding Crypto API template pattern where crypto_attr_alg_name() results are validated before string-specific use.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64314
EUVD
EUVD-2026-49026

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's crypto module, specifically in the ChaCha20-Poly1305 encryption algorithm implementation. The issue occurs in the chachapoly_create() function which incorrectly handles a malformed template argument. When a required parameter is missing, the function attempts to use an error pointer in a string comparison, leading to a potential crash or undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem and does not have a direct network detection method. To detect if your system is affected, check the kernel version and verify if it includes the vulnerable chacha20poly1305 implementation. Use commands like 'uname -a' to check the kernel version and inspect kernel logs for crypto-related errors.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or triggering undefined behavior in the kernel. It may also enable local privilege escalation if exploited successfully. Systems using the affected crypto module are at risk.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor vendor advisories for patches and apply them promptly. If immediate patching is not possible, consider disabling the chacha20poly1305 crypto module if it is not essential for your system's operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart