CVE-2026-64313: crypto: ecc - Fix carry overflow in vli multiplication
crypto: ecc - Fix carry overflow in vli multiplication
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Upgrade
Upgrade
Linux kernel (crypto: ecc - Fix carry overflow in vli multiplication)to a version that resolves this vulnerability.Patch 3c4b23901a0c - Compensating control
If you cannot upgrade immediately, ensure systems are protected at the network/host level (e.g., restrict access to services that use ECDH/ECC operations) until the kernel fix from commit 3c4b23901a0c is applied.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates adjacent-network attack access, with no privileges or user interaction required. The reported impact includes high confidentiality, integrity, and availability effects.
Which systems are identified as affected?
The listed software includes the Linux kernel and Microsoft azl3 kernel 6.6.144.1-1. The issue is in the kernel crypto ECC implementation.
What should be checked to determine whether a system needs remediation?
Check whether the running or deployed kernel includes the vulnerable crypto/ecc.c implementation and whether it contains one of the referenced stable fixes. The provided references identify the relevant stable kernel commits.