CVE-2026-64544

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents<br /> <br /> pefile_digest_pe_contents() computes the trailing-data hash length as<br /> pelen - (hashed_bytes + certs_size). A crafted PE can make the addition<br /> exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.<br /> This is passed to crypto_shash_update() which reads out of bounds and<br /> panics on unmapped vmalloc guard pages.<br /> <br /> BUG: unable to handle page fault for address: ffffc900038d8000<br /> Oops: Oops: 0000 [#1] SMP KASAN NOPTI<br /> RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)<br /> Call Trace:<br /> <br /> __sha256_update (lib/crypto/sha256.c:208)<br /> crypto_sha256_update (crypto/sha256.c:142)<br /> verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)<br /> kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)<br /> __do_sys_kexec_file_load (kernel/kexec_file.c:406)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)<br /> <br /> Kernel panic - not syncing: Fatal exception<br /> <br /> Validate that the addition does not overflow and the result does not<br /> exceed pelen before the subtraction. Return -ELIBBAD on failure.