CVE-2026-64544: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64544 Overview

CVE-2026-64544 is an out-of-bounds read vulnerability in the Linux kernel's asymmetric keys subsystem. The flaw resides in pefile_digest_pe_contents() within crypto/asymmetric_keys/verify_pefile.c. The function computes the trailing-data hash length as pelen - (hashed_bytes + certs_size) without validating the addition. A crafted Portable Executable (PE) file can cause the addition to exceed pelen, triggering an unsigned integer underflow to approximately 4 GiB. The resulting length is passed to crypto_shash_update(), which reads beyond mapped memory and panics on unmapped vmalloc guard pages. The bug is reachable through kexec_file_load() during PE signature verification.

Critical Impact
A local user with privileges to invoke kexec_file_load() can supply a malformed PE file to trigger a kernel panic, resulting in denial of service.

Affected Products

Linux kernel versions containing pefile_digest_pe_contents() in crypto/asymmetric_keys/verify_pefile.c
Distributions shipping kernels with CONFIG_KEXEC_FILE and PE signature verification enabled
Systems using signed kernel image verification via kexec

Discovery Timeline

2026-07-27 - CVE-2026-64544 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64544

Vulnerability Analysis

The vulnerability is an integer underflow leading to an out-of-bounds read [CWE-125, CWE-191]. The function pefile_digest_pe_contents() calculates the size of trailing data to hash using the expression pelen - (hashed_bytes + certs_size). Both operands originate from attacker-influenced fields in the PE file structure. When hashed_bytes + certs_size exceeds pelen, the unsigned subtraction wraps around to a value near 4 GiB. This oversized length flows into crypto_shash_update() via crypto_sha256_update(). The hash routine walks memory well past the mapped PE buffer and faults on vmalloc guard pages, producing a kernel panic.

Root Cause

The root cause is missing arithmetic overflow validation before an unsigned subtraction. Neither the sum hashed_bytes + certs_size nor its relationship to pelen is bounds-checked. The upstream fix validates that the addition does not overflow and that the sum does not exceed pelen, returning -ELIBBAD when either condition fails.

Attack Vector

Exploitation requires local access with the capability to invoke kexec_file_load(), which typically demands CAP_SYS_BOOT. An attacker crafts a PE image with header fields that make hashed_bytes + certs_size exceed the actual file length. When the kernel calls kexec_kernel_verify_pe_sig() during load, the underflowed length triggers the fault. The observed call chain proceeds from __do_sys_kexec_file_load through verify_pefile_signature to crypto_sha256_update and sha256_blocks_generic, terminating in a page fault at an unmapped address such as ffffc900038d8000.

No verified public exploit code is available. See the referenced Kernel Update Commit for the exact patch logic.

Detection Methods for CVE-2026-64544

Indicators of Compromise

Kernel oops messages referencing sha256_blocks_generic, __sha256_update, or verify_pefile_signature in the call trace
Page fault entries in dmesg at high vmalloc addresses (e.g., ffffc9xxxxxxxxxx) during kexec_file_load invocations
Unexpected kernel panics with the message "Kernel panic - not syncing: Fatal exception" following a kexec_file_load syscall
Repeated failed kexec_file_load() attempts from unprivileged or unusual processes

Detection Strategies

Monitor audit logs for kexec_file_load syscall (syscall number 320 on x86_64) invocations and correlate with process identity.
Inspect /var/log/kern.log and journalctl -k for oops signatures involving verify_pefile_signature.
Deploy kernel version inventory checks across the fleet to identify hosts running unpatched kernels.
Track processes attempting to load unsigned or malformed PE images via kexec.

Monitoring Recommendations

Enable auditd rules for the kexec_file_load syscall and alert on non-administrator invocations.
Aggregate kernel logs into a centralized SIEM to detect crash signatures across the fleet.
Baseline expected users of CAP_SYS_BOOT and alert on capability grants outside of that baseline.

How to Mitigate CVE-2026-64544

Immediate Actions Required

Apply the upstream stable kernel commits that add overflow validation in pefile_digest_pe_contents().
Restrict CAP_SYS_BOOT to administrative accounts and remove it from any non-essential service accounts.
Reboot affected systems after patching to ensure the fixed kernel is running.
Prioritize patching on hosts that permit unattended kexec operations or multi-tenant workloads.

Patch Information

The fix is available in multiple stable branches. Relevant commits include 627938383761, 6acd2fbd00f9, 7016377699b5, 803591785d33, 89efd998470a, b798ada5a5d1, e162bc386e71, and f7dd32c5179d. The patch validates the addition and returns -ELIBBAD when the computed length is inconsistent.

Workarounds

Disable CONFIG_KEXEC_FILE in kernel builds where kexec-based boot is not required.
Remove CAP_SYS_BOOT from user namespaces and non-root workloads until patches are applied.
Enable kernel lockdown mode to restrict runtime kernel modifications, including kexec operations.

bash

# Verify running kernel and restrict kexec capability
uname -r

# Audit kexec_file_load usage via auditd
auditctl -a always,exit -F arch=b64 -S kexec_file_load -k kexec_monitor

# List processes/users with CAP_SYS_BOOT
getcap -r / 2>/dev/null | grep cap_sys_boot