Executive brief
The Linux kernel's QCE (Qualcomm Crypto Engine) cryptographic driver contains a flaw in its error recovery path during algorithm registration. When registering multiple cryptographic algorithms fails, the error handler incorrectly cleans up by repeatedly calling the same unregister function instead of properly unwinding previously registered algorithms, leaving the system in an inconsistent state.
Technical details
This is a logic error in the error path of the devm_qce_register_algs() function in drivers/crypto/qce/core.c. When ops->register_algs() fails during iteration over multiple algorithm providers, the code attempts to unregister previously registered algorithms by calling ops->unregister_algs(qce) repeatedly in a loop. However, the bug is that it uses the wrong ops pointer—it calls the same failed ops->unregister_algs() instead of using qce_ops[j]->unregister_algs(qce) to target each previously registered provider. This causes improper cleanup, potentially leaving registered algorithm state in an invalid condition. The fix changes line to use qce_ops[j]->unregister_algs(qce) with the correct loop index to properly unwind each prior registration. No user interaction or special preconditions are required; the vulnerability is triggered when algorithm registration fails during module initialization or driver probe.
Affected products
- Linux Linux kernel 5.0 and later affected versions prior to fix (exact affected range spans numerous stable series from 5.0.y through 7.y kernels)
Timeline
- 2026-08-26: disclosed: CVE-2026-80565 published
- 2026-07-24: patched: Fix commit 9c75402286409f5e1a75e4a445555c84066f89db authored by Thorsten Blum and merged into stable kernel trees