CVE-2026-64313 Overview
CVE-2026-64313 affects the Linux kernel's Elliptic Curve Cryptography (ECC) implementation. The vulnerability resides in the variable-length integer (VLI) multiplication routine within crypto/ecc.c. A carry flag calculation fails to account for overflow when the high 64-bit word of an intermediate product is saturated at 0xFFFFFFFFFFFFFFFF and the lower-bit addition also overflows. The defect was introduced when commit 3c4b23901a0c ("crypto: ecdh - Add ECDH software support") split the muladd() helper from the micro-ecc library into separate mul_64_64() and add_128_128() functions.
Critical Impact
An adjacent-network attacker can trigger incorrect ECC computations, undermining the integrity of cryptographic operations that depend on the kernel's ECDH implementation.
Affected Products
- Linux kernel crypto/ecc.c implementation of VLI multiplication
- Kernel builds using the ECDH software provider (crypto: ecdh)
- Downstream distributions shipping vulnerable stable kernel branches
Discovery Timeline
- 2026-07-25 - CVE-2026-64313 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64313
Vulnerability Analysis
The vulnerability is an integer overflow in the carry propagation logic of the kernel's ECC big-integer multiplication routine. The routine composes 128-bit values from 64-bit multiplications and then adds these 128-bit intermediates together. Correct carry detection is required to preserve arithmetic integrity across the multi-word result.
The existing check (r01.m_high < product.m_high) detects the common case where addition of the high halves wraps around. It does not, however, cover the edge case where r01.m_high == product.m_high and an additional carry propagates upward from the lower-half addition. When both conditions align, the code fails to record a carry bit, silently corrupting the multi-word result.
Because the flaw sits inside a primitive used by higher-level ECDH operations, any consumer of the kernel crypto API that performs elliptic curve scalar arithmetic can be affected. The result is not a memory-safety issue but a cryptographic correctness issue that can be observed and, in some cases, provoked by an adversary controlling curve inputs.
Root Cause
The root cause is an incomplete boundary check introduced during code refactoring. When commit 3c4b23901a0c split the original muladd() helper into mul_64_64() and add_128_128(), the carry propagation from the low-half addition into the high-half comparison was omitted. Only the strict < comparison remained, leaving the equality-plus-lower-carry case unhandled.
Attack Vector
The attack vector is adjacent network with low complexity and no privileges or user interaction required. An attacker on an adjacent network can submit crafted values to a kernel service that invokes the in-kernel ECDH implementation (for example, key-agreement operations used by IPsec, WireGuard variants relying on kernel crypto, or Bluetooth key exchange). By selecting inputs that trigger the carry-boundary condition, the attacker can cause incorrect ECC results, which may translate into confidentiality, integrity, or availability impact on protocols that trust these computations.
No verified public exploit code is available. See the referenced kernel git commits for the corrected arithmetic logic.
Detection Methods for CVE-2026-64313
Indicators of Compromise
- Unexplained failures or anomalies in kernel-mode ECDH key agreement, including inconsistent shared secrets between peers
- Kernel log entries referencing crypto/ecc.c faults or ECDH negotiation failures on adjacent-network protocols
- Repeated key-exchange retries from adjacent hosts targeting services that invoke kernel ECC
Detection Strategies
- Inventory kernel versions across Linux hosts and flag builds that do not include the fix commits referenced in the NVD entry
- Correlate cryptographic error events with source IP addresses on the local network segment to identify probing behavior
- Use configuration compliance tooling to confirm that crypto/ecc.c has been rebuilt from patched sources on all affected systems
Monitoring Recommendations
- Monitor dmesg and journald for crypto subsystem errors and ECDH negotiation failures
- Alert on abnormal volumes of failed key exchanges on services such as IPsec, MACsec, and Bluetooth pairing
- Track kernel package versions in your endpoint inventory and flag hosts running pre-patch stable kernels
How to Mitigate CVE-2026-64313
Immediate Actions Required
- Apply the vendor-supplied kernel update that includes the carry-overflow fix in crypto/ecc.c and reboot affected hosts
- Prioritize patching of systems that expose kernel ECDH to adjacent networks, including VPN concentrators, wireless access points, and Bluetooth-enabled endpoints
- Verify that all long-running virtual machines and containers inherit the patched host kernel where applicable
Patch Information
The fix adds proper handling of the carry generated by the lower-half addition, ensuring that the high-half comparison correctly detects overflow when r01.m_high == product.m_high. Patched commits are published in the stable trees, including Kernel Git Commit 24a54dfa, Kernel Git Commit 27b536a, Kernel Git Commit 5275e0fc, Kernel Git Commit 677450e5, Kernel Git Commit 774ddddf, Kernel Git Commit b709e0e7, Kernel Git Commit d11b2bb9, and Kernel Git Commit ebaae7c4.
Workarounds
- Restrict adjacent-network access to services that invoke kernel ECDH, using firewall rules and network segmentation until patching is complete
- Where feasible, prefer userspace cryptographic libraries that do not route through the vulnerable kernel path for ECDH operations
- Disable optional kernel modules that expose ECDH to untrusted adjacent hosts if they are not required for operations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
