Look up another CVE · open CVE-2026-64312 in the interactive tracker

CVE-2026-64312

crypto: pcrypt - restore callback for non-parallel fallback

7.5 EPSS 0.5% AV:N

Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem crypto. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-64312 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixedDLA-4720-1 · 2026-08-05 · text	6.1.180-1	Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.96-1	Update the kernel and reboot. Fixed in 6.12.96-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.1.4-1	Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.4-1	Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts.
Debian 12bookworm · linux-6.12	fixedDLA-4724-1 · 2026-08-07 · text	6.12.100-1~deb12u1	Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() returns -EBUSY, pcrypt falls back to calling the child AEAD directly. That fallback must not keep the padata completion callback. Otherwise an asynchronous completion runs pcrypt_aead_done() even though the request was never enrolled in padata. Restore the original request callback and callback data before calling the child AEAD directly. This keeps the fallback path aligned with a direct AEAD request while leaving the parallel path unchanged.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

crypto/pcrypt.c

What this is: PCRYPT PARALLEL CRYPTO ENGINEMAINTAINERS section matched on crypto/pcrypt.c · linux-crypto@vger.kernel.org · Maintained
Kernel module: pcrypt

Check it on the machine

grep -w CONFIG_CRYPTO_PCRYPT /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w pcrypt

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookwormm
trixieMnot built on armel/rpi
forky, sid, bookworm · linux-6.12m

m: a loadable module on every flavour - check lsmod, can be blacklisted
M: a module where it is built at all; some flavours do not build it

Build switch: CONFIG_CRYPTO_PCRYPT

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-25 (3 months ago)source
CVSS: 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.50%, higher than 41.6% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: crypto

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
5.10.231	5.10.261	81ce16d938db
5.15.174	5.15.212	3920c5f6edc3
6.1.120	6.1.178	ae93c5b3e2a2
6.6.64	6.6.145	82789a44415e
6.12.2	6.12.96	4711ca06bd16
6.13	6.18.39	c4bd2f4c35b0
6.13	7.1.4	83fa1397d585
6.13	7.2	ed459fe31937
4.19.325	0	0
5.4.287	0	0
6.11.11	0	0

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4724-1	2026-08-07	bookworm 6.12.100-1~deb12u1	tracker
DLA-4723-1	2026-08-07	bullseye 6.1.180-1~deb11u1	tracker
DLA-4720-1	2026-08-05	bookworm 6.1.180-1	tracker
DLA-4717-1	2026-08-05	bullseye 5.10.262-1	tracker

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().
AC:LAttack complexity, low: In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.
PR:NPrivileges required, none: The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.
UI:NUser interaction, none: Packet delivery and asynchronous completion require no victim action.
S:UScope, unchanged: The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.
C:NConfidentiality impact, none: The rejected request retains a zero padata->pd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.
I:NIntegrity impact, none: The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.
A:HAvailability impact, high: padata_do_serial() dereferences the uninitialized padata->pd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered.