PT-2026-65219 · Linux · Linux
CVE-2026-64544
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
crypto: asymmetric keys - fix OOB read in pefile digest pe contents
pefile digest pe contents() computes the trailing-data hash length as
pelen - (hashed bytes + certs size). A crafted PE can make the addition
exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.
This is passed to crypto shash update() which reads out of bounds and
panics on unmapped vmalloc guard pages.
BUG: unable to handle page fault for address: ffffc900038d8000
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:sha256 blocks generic (lib/crypto/sha256.c:152)
Call Trace:
sha256 update (lib/crypto/sha256.c:208)
crypto sha256 update (crypto/sha256.c:142)
verify pefile signature (crypto/asymmetric keys/verify pefile.c:436)
kexec kernel verify pe sig (kernel/kexec file.c:151)
do sys kexec file load (kernel/kexec file.c:406)
do syscall 64 (arch/x86/entry/syscall 64.c:94)
entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:121)
Kernel panic - not syncing: Fatal exception
Validate that the addition does not overflow and the result does not
exceed pelen before the subtraction. Return -ELIBBAD on failure.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux