{"id":"CVE-2026-64304","summary":"crypto: qat - validate RSA CRT component lengths","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - validate RSA CRT component lengths\n\nThe generic RSA key parser (rsa_helper.c) bounds each CRT component (p,\nq, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()\nallocates half-size DMA buffers (key_sz / 2) and right-aligns each\ncomponent with:\n\n    memcpy(dst + half_key_sz - len, src, len)\n\nWhen a CRT component is larger than half_key_sz the subtraction\nunderflows and memcpy writes past the DMA buffer, causing memory\ncorruption.\n\nAdd a len \u003e half_key_sz check next to the existing !len check for each\nof the five CRT components so the driver falls back to the non-CRT path\ninstead of writing out of bounds.","modified":"2026-07-28T04:03:04.361745854Z","published":"2026-07-25T08:49:38.873Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64304.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1002719d13072a5e4be1e993aa61dffb4a604e82"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3d61a214fdcda41f1ebfabbb483404032a7b4d91"},{"type":"WEB","url":"https://git.kernel.org/stable/c/500319830d76911c120dc0b9605f8c16d7702844"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6d99c5fadd2df488103f64d6475b63ba6852202b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b3ac78756588059729b9195fcc9f4b37d54057a5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c34369473bfe92a0b46ec78d6358e30341c7f481"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ce42224487c504aee4b7ff3a7342e7b4d7e28cc9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64304.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64304"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"879f77e9071f029e1c9bd5a75814ecf51370f846"},{"fixed":"6d99c5fadd2df488103f64d6475b63ba6852202b"},{"fixed":"c34369473bfe92a0b46ec78d6358e30341c7f481"},{"fixed":"1002719d13072a5e4be1e993aa61dffb4a604e82"},{"fixed":"500319830d76911c120dc0b9605f8c16d7702844"},{"fixed":"3d61a214fdcda41f1ebfabbb483404032a7b4d91"},{"fixed":"6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a"},{"fixed":"ce42224487c504aee4b7ff3a7342e7b4d7e28cc9"},{"fixed":"b3ac78756588059729b9195fcc9f4b37d54057a5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64304.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.8.0"},{"fixed":"5.10.261"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.96"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64304.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}