Executive brief
A vulnerability in the Linux kernel's Intel QuickAssist Technology (QAT) driver could allow for memory corruption. This component is used to accelerate cryptographic operations like RSA encryption. An exploit could lead to system instability or potentially allow an attacker to compromise the security of the operating system.
Technical details
A buffer overflow exists in the qat_rsa_setkey_crt() function within the Intel QAT driver (qat_asym_algs.c). The driver allocates DMA buffers based on half the modulus size (key_sz / 2) but fails to verify that individual CRT components (p, q, dp, dq, qinv) fit within this size. When a component exceeds this limit, a pointer subtraction underflows during a right-alignment memcpy operation, leading to an out-of-bounds write and memory corruption. The fix introduces a length check to ensure components do not exceed the allocated buffer size, falling back to a non-CRT path if they do.
Affected products
- Linux Linux Kernel 4.8 to 5.10.261, 5.15.164, 6.1.101, 6.6.42, 6.9.11, 6.10.1
Timeline
- 2026-07-20: disclosed: Initial patch authored by Giovanni Cabiddu
- 2026-07-24: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2026-07-25: advisory: CVE-2026-64304 published
References
- https://git.kernel.org/stable/c/1002719d13072a5e4be1e993aa61dffb4a604e82
- https://git.kernel.org/stable/c/3d61a214fdcda41f1ebfabbb483404032a7b4d91
- https://git.kernel.org/stable/c/500319830d76911c120dc0b9605f8c16d7702844
- https://git.kernel.org/stable/c/6d99c5fadd2df488103f64d6475b63ba6852202b
- https://git.kernel.org/stable/c/6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a
- https://git.kernel.org/stable/c/b3ac78756588059729b9195fcc9f4b37d54057a5
- https://git.kernel.org/stable/c/c34369473bfe92a0b46ec78d6358e30341c7f481