{"id":"CVE-2026-64312","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata.  If…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","published":"2026-07-25","updated":"2026-07-27","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64312","references":[{"url":"https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64312.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64312"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507144"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64312"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64312"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072509-CVE-2026-64312-2566@gregkh/T"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00501,"epssPercentile":0.42711,"ingestedAt":"2026-07-27T06:16:50.347Z","vendor":"Linux","product":"Linux","affected":["Linux >= a92ccd3618e42333ac6f150ecdac14dca298bc7a < 81ce16d938db9b88cdc231522c0358395ae8c6b5","Linux >= 96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca < 3920c5f6edc341729d20d0507e466c6d3b11f372","Linux >= 92834692a539b5b7f409e467a14667d64713b732 < ae93c5b3e2a2968b56d772ca1d06615927b7cc36","Linux >= 5edae7a9a35606017ee6e05911c290acee9fee5a < 82789a44415e3e31168229421b138278dfb16412","Linux >= 7ddab756f2de5b7b43c122ebebdf37f400fb2b6f < 4711ca06bd169a2cbc9cc59a6de2ed512c41a880","Linux >= 662f2f13e66d3883b9238b0b96b17886179e60e2 < c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf","Linux >= 662f2f13e66d3883b9238b0b96b17886179e60e2 < 83fa1397d5853de1e27dd52ec44b068ff358ca18","Linux >= 662f2f13e66d3883b9238b0b96b17886179e60e2 < ed459fe319376e876de433d12b6c6772e612ca36","Linux dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6","Linux fca8aed12218f96b38e374ff264d78ea1fbd23cc","Linux a8e0074ffb38c9a5964a221bb998034d016c93a2","Linux >= 5.10.231 < 5.10.261","Linux >= 5.15.174 < 5.15.212","Linux >= 6.1.120 < 6.1.178","Linux >= 6.6.64 < 6.6.145","Linux >= 6.12.2 < 6.12.96","Linux >= 4.19.325 < 4.20","Linux >= 5.4.287 < 5.5","Linux >= 6.11.11 < 6.12","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:38:50.962318Z"},"cwe":["CWE-430"],"scores":{"nvd":7.5,"vendor":7},"slug":"CVE-2026-64312","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata.  If padata_do_parallel() returns\n-EBUSY, pcrypt falls back to calling the child AEAD directly.\n\nThat fallback must not keep the padata completion callback.  Otherwise\nan asynchronous completion runs pcrypt_aead_done() even though the\nrequest was never enrolled in padata.\n\nRestore the original request callback and callback data before calling\nthe child AEAD directly.  This keeps the fallback path aligned with a\ndirect AEAD request while leaving the parallel path unchanged.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64312.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}