CVE-2026-64544

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

pefile_digest_pe_contents() computes the trailing-data hash length as

pelen - (hashed_bytes + certs_size). A crafted PE can make the addition

exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.

This is passed to crypto_shash_update() which reads out of bounds and

panics on unmapped vmalloc guard pages.

BUG: unable to handle page fault for address: ffffc900038d8000

Oops: Oops: 0000 [#1] SMP KASAN NOPTI

RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)

Call Trace:

<TASK>

__sha256_update (lib/crypto/sha256.c:208)

crypto_sha256_update (crypto/sha256.c:142)

verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)

kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)

__do_sys_kexec_file_load (kernel/kexec_file.c:406)

do_syscall_64 (arch/x86/entry/syscall_64.c:94)

entry_SYSCALL_64_after_hwframe (arc

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References