CVE-2026-64314 Overview
CVE-2026-64314 is a Linux kernel vulnerability in the chacha20poly1305 Crypto API template. The chachapoly_create() function accepts the compatibility poly1305 parameter but assumes a second template argument is always present. When that argument is missing, crypto_attr_alg_name() returns an error pointer, which the code passes directly to strcmp() without validation. This dereferences an error pointer during malformed template instantiation.
Critical Impact
A malformed crypto template instantiation triggers an error-pointer dereference in kernel context, resulting in a kernel crash and local denial of service.
Affected Products
- Linux kernel (stable branches containing chachapoly_create() in crypto/chacha20poly1305.c)
- Distributions shipping vulnerable stable kernel versions prior to the referenced fix commits
- Systems using the Crypto API chacha20poly1305 template with the poly1305 compatibility parameter
Discovery Timeline
- 2026-07-25 - CVE-2026-64314 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64314
Vulnerability Analysis
The Linux kernel Crypto API supports composite algorithm templates that combine primitives at instantiation time. The chachapoly_create() function in crypto/chacha20poly1305.c constructs a ChaCha20-Poly1305 authenticated encryption instance from template arguments supplied by callers.
For backward compatibility, the function accepts the legacy poly1305 parameter as the second template argument. To identify this case, the code retrieves the argument via crypto_attr_alg_name() and immediately compares the returned string against "poly1305" using strcmp(). The function omits the validation step that surrounding Crypto API code applies before consuming the return value.
When a caller instantiates the template without a second argument, crypto_attr_alg_name() returns an ERR_PTR value rather than a valid string pointer. Passing that error pointer to strcmp() dereferences an invalid address in kernel context. The fix adds an IS_ERR() check so malformed template requests fail cleanly with an error return.
Root Cause
The root cause is missing input validation on the return value of crypto_attr_alg_name(). The Crypto API contract requires callers to check for error pointers before dereferencing, and the surrounding template code follows this pattern. chachapoly_create() broke that contract for the poly1305 compatibility path.
Attack Vector
An attacker with the ability to request algorithm instantiation through the Crypto API can trigger the bug. Interfaces exposing this include AF_ALG sockets, which unprivileged users may access on many distributions, and in-kernel consumers that accept user-controlled algorithm names. Successful triggering causes a kernel oops or panic, producing local denial of service.
Detection Methods for CVE-2026-64314
Indicators of Compromise
- Kernel oops or panic messages referencing chachapoly_create or crypto/chacha20poly1305.c in dmesg or /var/log/kern.log
- Unexpected process termination for services performing AF_ALGbind() calls with malformed chacha20poly1305(...) names
- Repeated socket(AF_ALG, ...) activity from unprivileged processes followed by kernel fault entries
Detection Strategies
- Monitor kernel logs for fault traces containing the chachapoly_create symbol and null-page or error-pointer addresses
- Audit user-space use of AF_ALG sockets and record algorithm names passed to bind() via struct sockaddr_alg
- Correlate crash telemetry with the running kernel version to identify unpatched hosts still exposing the vulnerable code path
Monitoring Recommendations
- Ingest kernel and audit facility logs into a centralized platform and alert on chacha20poly1305 template errors
- Track kernel version inventory across Linux fleets and flag hosts running versions preceding the fix commits
- Alert on repeated crypto template instantiation failures originating from non-root processes
How to Mitigate CVE-2026-64314
Immediate Actions Required
- Apply the upstream stable kernel updates that include the fix commits and reboot affected systems
- Inventory hosts exposing AF_ALG to unprivileged users and prioritize patching those systems first
- Restrict access to the Crypto API user-space interface where it is not required by applications
Patch Information
The issue is resolved in the Linux stable tree by commits 0016d3c21c6a, 265b861bece3, and e74df53b36cd. The patches add an IS_ERR() check on the result of crypto_attr_alg_name() in chachapoly_create() before invoking strcmp(), matching the validation pattern used elsewhere in the Crypto API template code.
Workarounds
- Disable the AF_ALG socket family via kernel configuration or module blacklisting where user-space crypto access is not required
- Apply seccomp filters to block socket(AF_ALG, ...) calls from untrusted processes
- Use SELinux or AppArmor policies to prevent unprivileged binaries from binding AF_ALG sockets with attacker-controlled algorithm strings
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
