Not yet scoredPublished Jul 27, 2026

CVE-2026-64544crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

Updated under an hour ago (Oct 26, 2026, 4:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents pefile_digest_pe_contents() computes the trailing-data hash length as pelen - (hashed_bytes + certs_size). A crafted PE can make the addition exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB. This is passed to crypto_shash_update() which reads out of bounds and panics on unmapped vmalloc guard pages. BUG: unable to handle page fault for address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152) Call Trace: <TASK> __sha256_update (lib/crypto/sha256.c:208) crypto_sha256_update (crypto/sha256.c:142) verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436) kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (kernel/kexec_file.c:406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Kernel panic - not syncing: Fatal exception Validate that the addition does not overflow and the result does not exceed pelen before the subtraction. Return -ELIBBAD on failure.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from af316fc442ef23901bbfcec5af55e69ca6ce9563 before 89efd998470a93284b7ad5a20d4e0e3c6858ae8e; from af316fc442ef23901bbfcec5af55e69ca6ce9563 before 7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c; from af316fc442ef23901bbfcec5af55e69ca6ce9563 before b798ada5a5d1cb4cc4cfa72074b1b463eca6c506; from af316fc442ef23901bbfcec5af55e69ca6ce9563 before 627938383761fb4334b41ebe7ef438d6b8b19d60; from af316fc442ef23901bbfcec5af55e69ca6ce9563 before e162bc386e71b5412425a38ee048e8d2185491b9; from af316fc442ef23901bbfcec5af55e69ca6ce9563 before 6acd2fbd00f9c72aebefce63fc2e73e8f3d79061; from af316fc442ef23901bbfcec5af55e69ca6ce9563 before 803591785d33cf13b6f73ce2796e8b9e6d5e6526; from af316fc442ef23901bbfcec5af55e69ca6ce9563 before f7dd32c5179d7755de18e21d5674b08f9e5cb180	CNA record

References

References

https://git.kernel.org/stable/c/89efd998470a93284b7ad5a20d4e0e3c6858ae8e
https://git.kernel.org/stable/c/7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c
https://git.kernel.org/stable/c/b798ada5a5d1cb4cc4cfa72074b1b463eca6c506
https://git.kernel.org/stable/c/627938383761fb4334b41ebe7ef438d6b8b19d60
https://git.kernel.org/stable/c/e162bc386e71b5412425a38ee048e8d2185491b9
https://git.kernel.org/stable/c/6acd2fbd00f9c72aebefce63fc2e73e8f3d79061
https://git.kernel.org/stable/c/803591785d33cf13b6f73ce2796e8b9e6d5e6526
https://git.kernel.org/stable/c/f7dd32c5179d7755de18e21d5674b08f9e5cb180

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.