CVE-2026-64314

MediumCVSS 5.5/10Last modified Oct 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: chacha20poly1305 - validate poly1305 template argument

chachapoly_create() still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediately passes it to strcmp().

When the argument is missing, crypto_attr_alg_name() returns an error pointer. Check for that before comparing the name so malformed template instantiations fail with an error instead of dereferencing the error pointer in strcmp().

This matches the surrounding Crypto API template pattern where crypto_attr_alg_name() results are validated before string-specific use.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jul 25, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-643157.0In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use print_hex_dump_devel to guard key hex dumps Use priCVE-2026-643165.5In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use print_hex_dump_devel to guard key hex dumps Use priCVE-2026-643177.1In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record get_symlinCVE-2026-643187.1In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the pp_count scan to the ppe array aix_partitioCVE-2026-643199.1In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer lengCVE-2026-64325.3Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) CVE-2026-643209.1In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page CVE-2026-643215.5In the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmet_rdmaCVE-2026-643227.8In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count CVE-2026-643237.1In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vaCVE-2026-643247.8In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_freeCVE-2026-643255.5In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This pat
CVE-2026-64314: Medium severity, CVSS 5.5 | Vulnix