PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64312 Linux CVE debrief

A vulnerability in the Linux kernel's crypto: pcrypt has been resolved. The vulnerability arises from pcrypt installing pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() returns -EBUSY, pcrypt falls back to calling the child AEAD directly. That fallback must not keep the padata completion callback. Otherwise, an asynchronous completion runs pcrypt_aead_done() even though the request was never enrolled in padata. Restore the original request callback and callback data before calling the child AEAD directly. This keeps the fallback path aligned with a direct AEAD request while leaving the parallel path unchanged.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-25
Original CVE updated
2026-10-19
Advisory published
2026-07-25
Advisory updated
2026-10-19

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of affected Linux kernel versions should assess exposure and verify vulnerability status. This involves reviewing official advisories, assessing exposure, and applying patches or updates to affected systems. Security teams and vulnerability management teams should also be aware of the vulnerability and its potential impact.

Why it matters

The vulnerability in crypto: pcrypt of the Linux kernel requires verification of vulnerability status and exposure. Remediation involves updating to fixed versions or applying patches.

  • Verify vulnerability status of Linux kernel versions in use
  • Assess exposure and apply patches or updates to affected systems
  • Monitor for exploitation attempts

Technical summary

The Linux kernel's crypto: pcrypt vulnerability arises from improper handling of the padata completion callback during fallback operations. This could lead to asynchronous completion of pcrypt_aead_done() even when the request was not enrolled in padata. Affected product context includes Linux kernel versions, and defensive impact involves verifying vulnerability status and exposure. Source-grounded technical framing suggests restoring the original request callback and callback data before calling the child AEAD directly.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify vulnerability status. Remediation involves updating to fixed versions or applying patches. Monitoring for exploitation attempts is recommended.

Recommended defensive actions

  • Assess exposure by reviewing Linux kernel versions in use
  • Verify vulnerability status using official sources
  • Apply patches or updates to affected systems
  • Monitor for exploitation attempts
  • Review compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the vulnerability and its resolution. Linux kernel versions are affected, and patches are available. Evidence limits suggest verifying vulnerability status and exposure for Linux kernel maintainers, Linux distribution maintainers, and users of affected Linux kernel versions. Defensive verification tasks involve reviewing official advisories, assessing exposure, and applying patches or updates.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64312 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64312

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64312 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64312

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • crypto: pcrypt - restore callback for non-parallel fallback

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/64xxx/CVE-2026-64312.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.