CVE-2026-64304 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should be aware of this vulnerability and take steps to verify and apply patches to prevent potential issues. Affected Linux kernel versions require review and updates. The vulnerability requires verification and patching to prevent potential memory corruption issues.

Why it matters

CVE-2026-64304 is a HIGH severity vulnerability in the Linux kernel's crypto: qat component that requires verification and patching to prevent potential memory corruption issues.

• Memory corruption may occur if the vulnerability is exploited
• Verification of patches and updates is necessary to prevent potential issues
• Affected Linux kernel versions require review and updates

Technical summary

The Linux kernel's crypto: qat component has a vulnerability that allows for potential memory corruption due to improper validation of RSA CRT component lengths. The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size DMA buffers (key_sz / 2) and right-aligns each component. When a CRT component is larger than half_key_sz the subtraction underflows and memcpy writes past the DMA buffer, causing memory corruption.

Defensive priority

Linux kernel maintainers and users should prioritize verifying and applying patches to prevent potential memory corruption.

Recommended defensive actions

• Verify and apply patches for the Linux kernel's crypto: qat component
• Review and update affected Linux kernel versions
• Monitor for potential memory corruption issues
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to source code changes. The Linux kernel's crypto: qat component has a vulnerability that allows for potential memory corruption due to improper validation of RSA CRT component lengths. The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size DMA buffers (key_sz / 2) and right-aligns each component with:

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.