CVE-2026-64599 Overview
CVE-2026-64599 is a use-after-free vulnerability in the Linux kernel's Amlogic GXL crypto driver (amlogic_gxl_crypto). The flaw resides in meson_crypto_probe(), where a failed call to meson_allocate_chanlist() triggers duplicate cleanup of per-flow crypto engine resources. When partial allocation fails, the inner function unwinds its own state, and the outer probe path then calls meson_free_chanlist() again. The second teardown re-enters crypto_engine_exit() on an already destroyed kthread worker, producing a slab-use-after-free in kthread_destroy_worker() detected by KASAN.
Critical Impact
Local memory corruption in the kernel address space on Amlogic-based Linux systems, potentially leading to kernel panic or exploitation for privilege escalation during driver probe failure conditions.
Affected Products
- Linux kernel builds including the Amlogic GXL crypto driver (drivers/crypto/amlogic)
- Kernel versions confirmed vulnerable through v7.1 (reproduced on v7.1 with KASAN)
- Distributions shipping Amlogic ARM SoC support for GXL-family crypto hardware
Discovery Timeline
- 2026-08-06 - CVE-2026-64599 published to the National Vulnerability Database
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-64599
Vulnerability Analysis
The vulnerability is a double-free leading to use-after-free [CWE-416] in the Amlogic crypto probe path. meson_allocate_chanlist() sets up per-flow crypto engine workers using dma_alloc_attrs() in a loop. When any iteration fails, the function unwinds already-initialized flows through its local error path, tearing down crypto_engine instances and their kthread workers.
The caller, meson_crypto_probe(), does not distinguish between a fully-clean failure and a partially-cleaned failure. On error, it jumps to its error_flow label and unconditionally calls meson_free_chanlist(), which walks the same flow array and invokes crypto_engine_exit() on structures whose backing kthread worker was already released. This second call reads freed memory in kthread_destroy_worker().
Root Cause
The root cause is inconsistent ownership of cleanup responsibility between the allocator and its caller. meson_allocate_chanlist() performs partial rollback on failure, but the outer probe function assumes cleanup is still required. The fix keeps failure handling local to meson_allocate_chanlist() and returns a state that signals the outer path to skip meson_free_chanlist().
Attack Vector
Triggering the bug requires the probe path to encounter a memory allocation failure during driver initialization. Reproduction used a QEMU x86_64 guest with KASAN, forcing the second dma_alloc_attrs() call to return NULL. In production, exploitation is constrained to local contexts able to influence kernel allocator behavior or load the affected module under memory pressure. The vulnerability is not remotely reachable through normal network paths.
Details of the fix are described in the referenced stable-tree commits, including Linux Kernel Commit 5b45201 and Linux Kernel Commit 6d827ad.
Detection Methods for CVE-2026-64599
Indicators of Compromise
- KASAN report of slab-use-after-free in kthread_destroy_worker originating from meson_crypto_probe+0x4d0 in the amlogic_gxl_crypto module
- Kernel oops or panic during boot or module load on Amlogic GXL platforms when memory is constrained
- Repeated probe failures for amlogic_gxl_crypto accompanied by -ENOMEM and stack traces referencing crypto_engine_exit
Detection Strategies
- Enable KASAN on test kernels for Amlogic hardware to surface the double-free during driver probe
- Monitor dmesg and journalctl -k for BUG: KASAN entries pointing to meson_crypto_probe or kthread_destroy_worker
- Track kernel module load failures and correlate with allocation-failure events under memory pressure
Monitoring Recommendations
- Forward kernel logs from Amlogic-based devices to a centralized log store and alert on KASAN, BUG:, and Oops strings
- Baseline expected driver probe outcomes at boot; investigate deviations that show partial initialization of amlogic_gxl_crypto
- Track kernel version and patch state across fleet inventory to identify hosts still exposed to CVE-2026-64599
How to Mitigate CVE-2026-64599
Immediate Actions Required
- Apply the upstream Linux kernel patches that constrain cleanup to meson_allocate_chanlist() and skip the outer teardown on partial failure
- Rebuild and redeploy kernels for Amlogic GXL platforms using stable branches that include the referenced commits
- If patching is not immediately feasible, unload or blacklist the amlogic_gxl_crypto module on systems where the hardware crypto path is not required
Patch Information
The fix has been merged across multiple stable branches. Relevant commits include Linux Kernel Commit 6dda840, Linux Kernel Commit 6effdba, Linux Kernel Commit 84a00be, Linux Kernel Commit c2c48aa, Linux Kernel Commit c80360b, and Linux Kernel Commit f30e2b8. After applying the patch, the reproducer emits no KASAN report and the probe fails cleanly with -ENOMEM.
Workarounds
- Blacklist the amlogic_gxl_crypto module using /etc/modprobe.d/ on systems that do not need hardware crypto offload
- Ensure adequate DMA-coherent memory is available at boot to reduce the chance of hitting the failure path in meson_allocate_chanlist()
- Restrict local unprivileged access to hosts running unpatched kernels until the fix is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
