CVE-2026-64304: crypto: qat - validate RSA CRT component lengths

Published Jul 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - validate RSA CRT component lengths

The generic RSA key parser (rsahelper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size nsz, but qatrsasetkeycrt() allocates half-size DMA buffers (keysz / 2) and right-aligns each component with:

memcpy(dst + halfkeysz - len, src, len)

When a CRT component is larger than halfkeysz the subtraction underflows and memcpy writes past the DMA buffer, causing memory corruption.

Add a len > halfkeysz check next to the existing !len check for each of the five CRT components so the driver falls back to the non-CRT path instead of writing out of bounds.

Affected Software

8 affected components
The Linux Kernel Community Linux Kernel
Linux Linux kernel>=4.8<5.10.261
Linux Linux kernel>=5.11<5.15.212
Linux Linux kernel>=5.16<6.1.178
Linux Linux kernel>=6.2<6.6.145
Linux Linux kernel>=6.7<6.12.96
Linux Linux kernel>=6.13<6.18.39
Linux Linux kernel>=6.19<7.1.4

Event History

Jul 25, 2026
CVE Published
via MITRE·08:49 AM
Data Sourced
via MITRE·08:49 AM
DescriptionSeverity
Data Sourced
via Red Hat·10:06 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·10:17 AM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux kernel QAT crypto driver for RSA operations with CRT-formatted keys are exposed. The vulnerable path is specifically qat_rsa_setkey_crt().

2

What does an attacker need to trigger the memory corruption?

An attacker needs the ability to provide or cause use of an RSA CRT key in which one or more CRT components exceeds half the modulus size. The vulnerable component lengths are p, q, dp, dq, and qinv.

3

What happens when an oversized CRT component is processed?

The driver calculates an offset using half_key_sz minus the component length; if the component is larger, that subtraction underflows. The subsequent memcpy can write beyond the allocated DMA buffer and corrupt memory.

4

What is the mitigation if the patch cannot be applied immediately?

Avoid using RSA CRT keys with the QAT driver, particularly keys whose CRT components may exceed half the modulus size. The corrected behavior rejects such CRT handling and falls back to the non-CRT path instead of performing the out-of-bounds write.

5

How can I identify whether the affected code path is in use?

Determine whether RSA operations are being offloaded through the Linux kernel QAT crypto driver and whether CRT-formatted RSA keys are supplied to it. The relevant function is qat_rsa_setkey_crt().

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203