CVE-2026-64312

crypto: pcrypt - restore callback for non-parallel fallback

HIGH
7.5
CVSS Score
Published: July 25, 2026 at 08:49 AM UTC
Updated: October 24, 2026 at 01:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() returns -EBUSY, pcrypt falls back to calling the child AEAD directly. That fallback must not keep the padata completion callback. Otherwise an asynchronous completion runs pcrypt_aead_done() even though the request was never enrolled in padata. Restore the original request callback and callback data before calling the child AEAD directly. This keeps the fallback path aligned with a direct AEAD request while leaving the parallel path unchanged.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.19.325 ≤ v < 4.205.10.231 ≤ v < 5.10.2615.15.174 ≤ v < 5.15.2125.4.287 ≤ v < 5.56.1.120 ≤ v < 6.1.1786.11.11 ≤ v < 6.126.12.2 ≤ v < 6.12.966.13 ≤ v < 6.18.396.19 ≤ v < 7.1.46.6.64 ≤ v < 6.6.1454.19.3255.10.2315.15.1745.4.2875edae7a9a35606017ee6e05911c290acee9fee5a6.1.1206.11.116.12.26.136.6.64662f2f13e66d3883b9238b0b96b17886179e60e27ddab756f2de5b7b43c122ebebdf37f400fb2b6f92834692a539b5b7f409e467a14667d64713b73296001f52ae8c70e2c736d3e1e5dc53d5b521e5caa8e0074ffb38c9a5964a221bb998034d016c93a2a92ccd3618e42333ac6f150ecdac14dca298bc7add8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6fca8aed12218f96b38e374ff264d78ea1fbd23cc
Vendor states this is fixed in 3920c5f6edc341729d20d0507e466c6d3b11f372 (fixed)
Vendor states this is fixed in 4711ca06bd169a2cbc9cc59a6de2ed512c41a880 (fixed)
Vendor states this is fixed in 81ce16d938db9b88cdc231522c0358395ae8c6b5 (fixed)
Vendor states this is fixed in 82789a44415e3e31168229421b138278dfb16412 (fixed)
Vendor states this is fixed in 83fa1397d5853de1e27dd52ec44b068ff358ca18 (fixed)
Vendor states this is fixed in ae93c5b3e2a2968b56d772ca1d06615927b7cc36 (fixed)
Vendor states this is fixed in c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf (fixed)
Vendor states this is fixed in ed459fe319376e876de433d12b6c6772e612ca36 (fixed)
Affected range stops below 4.20, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.10.261 (unaffected)
Vendor states this is fixed in 5.15.212 (unaffected)
Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.1.178 (unaffected)
Affected range stops below 6.12, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.12.96 (unaffected)
Vendor states this is fixed in 6.13 (unaffected)
Vendor states this is fixed in 6.18.39 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1.4 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfoCWE-662

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card