CVE-2026-64312
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() returns -EBUSY, pcrypt falls back to calling the child AEAD directly. That fallback must not keep the padata completion callback. Otherwise an asynchronous completion runs pcrypt_aead_done() even though the request was never enrolled in padata. Restore the original request callback and callback data before calling the child AEAD directly. This keeps the fallback path aligned with a direct AEAD request while leaving the parallel path unchanged.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-07-25 10:17:12.373000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-64312",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-07-25T10:17:12.373",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata. If padata_do_parallel() returns\n-EBUSY, pcrypt falls back to calling the child AEAD directly.\n\nThat fallback must not keep the padata completion callback. Otherwise\nan asynchronous completion runs pcrypt_aead_done() even though the\nrequest was never enrolled in padata.\n\nRestore the original request callback and callback data before calling\nthe child AEAD directly. This keeps the fallback path aligned with a\ndirect AEAD request while leaving the parallel path unchanged."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: pcrypt - restaurar el callback para el mecanismo de reserva no paralelo\n\npcrypt instala pcrypt_aead_done() en la solicitud AEAD hija antes de intentar enviarla a través de padata. Si padata_do_parallel() devuelve -EBUSY, pcrypt recurre a llamar directamente a la AEAD hija.\n\nEse mecanismo de reserva no debe mantener el callback de finalización de padata. De lo contrario, una finalización asíncrona ejecuta pcrypt_aead_done() incluso aunque la solicitud nunca fue inscrita en padata.\n\nRestaurar el callback de solicitud original y los datos del callback antes de llamar directamente a la AEAD hija. Esto mantiene la ruta del mecanismo de reserva alineada con una solicitud AEAD directa mientras deja la ruta paralela sin cambios."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "a92ccd3618e42333ac6f150ecdac14dca298bc7a",
"lessThan": "81ce16d938db9b88cdc231522c0358395ae8c6b5",
"versionType": "git",
"status": "affected"
},
{
"version": "96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca",
"lessThan": "3920c5f6edc341729d20d0507e466c6d3b11f372",
"versionType": "git",
"status": "affected"
},
{
"version": "92834692a539b5b7f409e467a14667d64713b732",
"lessThan": "ae93c5b3e2a2968b56d772ca1d06615927b7cc36",
"versionType": "git",
"status": "affected"
},
{
"version": "5edae7a9a35606017ee6e05911c290acee9fee5a",
"lessThan": "82789a44415e3e31168229421b138278dfb16412",
"versionType": "git",
"status": "affected"
},
{
"version": "7ddab756f2de5b7b43c122ebebdf37f400fb2b6f",
"lessThan": "4711ca06bd169a2cbc9cc59a6de2ed512c41a880",
"versionType": "git",
"status": "affected"
},
{
"version": "662f2f13e66d3883b9238b0b96b17886179e60e2",
"lessThan": "c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf",
"versionType": "git",
"status": "affected"
},
{
"version": "662f2f13e66d3883b9238b0b96b17886179e60e2",
"lessThan": "83fa1397d5853de1e27dd52ec44b068ff358ca18",
"versionType": "git",
"status": "affected"
},
{
"version": "662f2f13e66d3883b9238b0b96b17886179e60e2",
"lessThan": "ed459fe319376e876de433d12b6c6772e612ca36",
"versionType": "git",
"status": "affected"
},
{
"version": "dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6",
"versionType": "git",
"status": "affected"
},
{
"version": "fca8aed12218f96b38e374ff264d78ea1fbd23cc",
"versionType": "git",
"status": "affected"
},
{
"version": "a8e0074ffb38c9a5964a221bb998034d016c93a2",
"versionType": "git",
"status": "affected"
},
{
"version": "5.10.231",
"lessThan": "5.10.261",
"versionType": "semver",
"status": "affected"
},
{
"version": "5.15.174",
"lessThan": "5.15.212",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.1.120",
"lessThan": "6.1.178",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.6.64",
"lessThan": "6.6.145",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.12.2",
"lessThan": "6.12.96",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.19.325",
"lessThan": "4.20",
"versionType": "semver",
"status": "affected"
},
{
"version": "5.4.287",
"lessThan": "5.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.11.11",
"lessThan": "6.12",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.13",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.13",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.261",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.212",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.178",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.145",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.96",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.39",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.4",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:38:50.962318Z",
"id": "CVE-2026-64312",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-662"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.325",
"versionEndExcluding": "4.20",
"matchCriteriaId": "3C960EB7-4E90-49E0-BB92-BE6F1B8CF26F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.287",
"versionEndExcluding": "5.5",
"matchCriteriaId": "2E049AFB-F729-4E03-87D4-2BB4FFA5E622"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.231",
"versionEndExcluding": "5.10.261",
"matchCriteriaId": "C98E5C11-7BF5-4969-8CAF-686C542E5299"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.174",
"versionEndExcluding": "5.15.212",
"matchCriteriaId": "DC79F23E-8949-45EC-ADA0-E703F7261B08"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.120",
"versionEndExcluding": "6.1.178",
"matchCriteriaId": "6330006E-C961-4B96-B89F-BA284785802A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.64",
"versionEndExcluding": "6.6.145",
"matchCriteriaId": "C3271AF3-9AD1-42CE-804E-1051350059C2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.11",
"versionEndExcluding": "6.12",
"matchCriteriaId": "4CBF5F6E-D446-4CAE-AAA4-413442319824"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.2",
"versionEndExcluding": "6.12.96",
"matchCriteriaId": "0E95D4E5-DF4F-446E-8F38-C81ED98D0F0F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.39",
"matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "7.1.4",
"matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}