CVE-2026-64544

crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

State: Published
Severity: Not scored
Published: Jul 27, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

pefile_digest_pe_contents() computes the trailing-data hash length as pelen - (hashed_bytes + certs_size). A crafted PE can make the addition exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB. This is passed to crypto_shash_update() which reads out of bounds and panics on unmapped vmalloc guard pages.

BUG: unable to handle page fault for address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152) Call Trace: <TASK> __sha256_update (lib/crypto/sha256.c:208) crypto_sha256_update (crypto/sha256.c:142) verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436) kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (kernel/kexec_file.c:406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Kernel panic - not syncing: Fatal exception

Validate that the addition does not overflow and the result does not exceed pelen before the subtraction. Return -ELIBBAD on failure.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 89efd998470a93284b7ad5a20d4e0e3c6858ae8eAffected af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 7016377699b5b25b7ec3c0bf2ec3f983c7e95f7cAffected af316fc442ef23901bbfcec5af55e69ca6ce9563 to before b798ada5a5d1cb4cc4cfa72074b1b463eca6c506Affected af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 627938383761fb4334b41ebe7ef438d6b8b19d60Affected af316fc442ef23901bbfcec5af55e69ca6ce9563 to before e162bc386e71b5412425a38ee048e8d2185491b9Affected af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 6acd2fbd00f9c72aebefce63fc2e73e8f3d79061Affected af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 803591785d33cf13b6f73ce2796e8b9e6d5e6526Affected af316fc442ef23901bbfcec5af55e69ca6ce9563 to before f7dd32c5179d7755de18e21d5674b08f9e5cb180Affected
LinuxLinux	3.17Affected before 3.17Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 89efd998470a93284b7ad5a20d4e0e3c6858ae8eAffected
af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 7016377699b5b25b7ec3c0bf2ec3f983c7e95f7cAffected
af316fc442ef23901bbfcec5af55e69ca6ce9563 to before b798ada5a5d1cb4cc4cfa72074b1b463eca6c506Affected
af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 627938383761fb4334b41ebe7ef438d6b8b19d60Affected
af316fc442ef23901bbfcec5af55e69ca6ce9563 to before e162bc386e71b5412425a38ee048e8d2185491b9Affected
af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 6acd2fbd00f9c72aebefce63fc2e73e8f3d79061Affected
af316fc442ef23901bbfcec5af55e69ca6ce9563 to before 803591785d33cf13b6f73ce2796e8b9e6d5e6526Affected
af316fc442ef23901bbfcec5af55e69ca6ce9563 to before f7dd32c5179d7755de18e21d5674b08f9e5cb180Affected

LinuxLinux

3.17Affected
before 3.17Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.