CVE-2026-80565

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is in devm_qce_register_algs() called only from qce_crypto_probe() during platform-driver initialization at boot or qcrypto module load, not from any network, ioctl, or AF_ALG userspace path.

AC:LAttack complexity, low

On modular builds an attacker can reload qcrypto under memory pressure to force register_algs() failure, and once algorithms leak the UAF is reliably triggered by normal kernel crypto consumers such as fscrypt selecting high-priority QCE transforms.

PR:LPrivileges required, low

After the flawed probe error path leaves QCE algorithms registered, unprivileged local processes on Qualcomm phones and embedded targets reach them through routine fscrypt/dm-crypt kernel crypto without capabilities or init-namespace root.

UI:NUser interaction, none

Exploitation requires no victim interaction beyond ordinary encrypted filesystem or storage activity that automatically exercises kernel crypto after the probe failure has occurred.

S:UScope, unchanged

Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain, not a VM, IOMMU, or sandbox boundary crossing.

C:HConfidentiality impact, high

Leaked algorithm templates retain tmpl->qce pointers to the devm-freed qce_device, creating a kernel heap use-after-free that can be leveraged for arbitrary kernel memory disclosure.

I:HIntegrity impact, high

The dangling qce_device UAF corrupts kernel heap objects and control fields (mutex, DMA, MMIO pointers) reachable from crypto request handlers, enabling arbitrary write and potential code execution.

A:HAvailability impact, high

Dereferencing the freed qce_device during QCE crypto operations can cause kernel oops, panic, or hang, and UAF corruption inherently threatens system availability.