CVE-2026-64544

Received Received - Intake

Integer Overflow in Linux Kernel PE File Signature Verification

Publication date: 2026-07-27

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents pefile_digest_pe_contents() computes the trailing-data hash length as pelen - (hashed_bytes + certs_size). A crafted PE can make the addition exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB. This is passed to crypto_shash_update() which reads out of bounds and panics on unmapped vmalloc guard pages. BUG: unable to handle page fault for address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152) Call Trace: <TASK> __sha256_update (lib/crypto/sha256.c:208) crypto_sha256_update (crypto/sha256.c:142) verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436) kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (kernel/kexec_file.c:406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Kernel panic - not syncing: Fatal exception Validate that the addition does not overflow and the result does not exceed pelen before the subtraction. Return -ELIBBAD on failure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-08-17

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-16

NVD

CVE-2026-64544

EUVD

EUVD-2026-49595

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a crafted Portable Executable (PE) file can cause an out-of-bounds read. The function pefile_digest_pe_contents incorrectly calculates a hash length by subtracting values from a total length. If the addition of hashed_bytes and certs_size exceeds pelen, it causes an unsigned underflow, leading to a large invalid length passed to crypto_shash_update(). This triggers a kernel panic due to reading unmapped memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's PE file signature verification. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version and compare it against patched versions.

Impact Analysis

This vulnerability can cause a system crash (kernel panic) when processing a malicious PE file. It may lead to denial of service if an attacker crafts a file to trigger the flaw. Systems using kexec to load signed kernel images with PE signatures are particularly affected.

Compliance Impact

This vulnerability causes a kernel panic due to out-of-bounds memory access, leading to system crashes. Such instability could disrupt data processing or storage operations, potentially violating availability requirements in GDPR or HIPAA. However, the specific impact on compliance depends on system configuration and use case.

Mitigation Strategies

Update your Linux kernel to the latest patched version immediately. If updating is not possible, disable kexec_file_load functionality by setting kernel parameter lockdown=confidentiality or lockdown=integrity to prevent loading signed PE files.

Hi! I’m here to help you understand CVE-2026-64544. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70