CVE-2026-80565 Overview
CVE-2026-80565 is a Linux kernel vulnerability in the Qualcomm Crypto Engine (QCE) driver. The flaw resides in the devm_qce_register_algs function, where an incorrect error-handling path repeatedly invokes ops->unregister_algs() for a registration that already failed. Instead of iterating backward through successfully registered algorithms, the driver calls the unregister routine against the failing entry, leading to memory corruption or state inconsistency in the kernel crypto subsystem.
Critical Impact
A local, low-privileged actor triggering the failure path in the QCE driver can corrupt kernel crypto state, resulting in high impact to confidentiality, integrity, and availability.
Affected Products
- Linux kernel branches containing the qce crypto driver prior to the referenced stable commits
- Distributions shipping Qualcomm Crypto Engine support on ARM/ARM64 platforms
- Downstream vendor kernels that inherit the devm_qce_register_algs implementation
Discovery Timeline
- 2026-08-26 - CVE-2026-80565 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80565
Vulnerability Analysis
The vulnerability affects the Qualcomm Crypto Engine (QCE) driver's algorithm registration helper devm_qce_register_algs. During driver initialization, the function iterates through a list of algorithm operation sets and calls ops->register_algs() for each entry. When one of these registration attempts fails, the error path is expected to unwind by unregistering only the algorithms that were previously registered successfully.
The defective error handler instead repeatedly calls ops->unregister_algs() on the same failed entry. This means algorithms registered before the failure remain leaked into the kernel crypto subsystem, while the failing entry's unregister routine is invoked against uninitialized or partially initialized state. The result is inconsistent driver state that a local attacker can leverage to influence kernel memory.
Root Cause
The root cause is an error-path logic error: the cleanup loop references the failing iteration's ops rather than iterating backward over successfully registered entries using the loop index. This is a classic resource-cleanup ordering bug in kernel driver initialization code.
Attack Vector
Exploitation requires local access with low privileges on a system exposing the QCE driver. An attacker who can influence driver initialization conditions, such as through module load parameters, device probing, or triggering a controlled registration failure, can drive the flawed error path. Successful exploitation yields high confidentiality, integrity, and availability impact within the kernel context.
No public exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the upstream fixes in Linux Kernel Commit 1ece8e16 and Linux Kernel Commit 4e88b4fd for the corrected unwind logic.
Detection Methods for CVE-2026-80565
Indicators of Compromise
- Kernel log entries from the qce driver indicating repeated unregister_algs invocations during probe failure
- Unexpected crypto algorithm registration errors emitted by crypto/qce/ code paths
- Kernel panics or oops traces referencing devm_qce_register_algs on affected platforms
Detection Strategies
- Inventory kernel versions across ARM/ARM64 fleets and flag builds lacking the referenced stable commits
- Monitor dmesg and journal output for anomalous QCE driver probe failures followed by unusual crypto subsystem behavior
- Correlate host telemetry with module load events for qce and its dependent crypto modules
Monitoring Recommendations
- Forward kernel ring buffer and syslog data to a central analytics platform for baseline comparison
- Alert on repeated driver probe failures or kernel warnings tied to the crypto subsystem
- Track patch state of Qualcomm-based devices via configuration management and package inventory data
How to Mitigate CVE-2026-80565
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by the eight commit hashes in the NVD entry
- Rebuild and redeploy vendor kernels that include the qce driver on Qualcomm platforms
- Restrict local shell access and module-loading privileges to trusted administrators only
Patch Information
The fix replaces the faulty error path with an index-based unwind loop that calls ops->unregister_algs() only on previously registered algorithms. Corrected implementations are available in Linux Kernel Commit 9c754022, Linux Kernel Commit a134e4b8, Linux Kernel Commit c7dc487a, Linux Kernel Commit dbca8b79, Linux Kernel Commit de52c713, and Linux Kernel Commit fef187c6. Consume the fix from your distribution's stable kernel update channel.
Workarounds
- Blacklist the qce module on systems where hardware crypto offload is not required
- Restrict access to accounts capable of loading kernel modules or triggering driver probes
- Enforce Secure Boot and module signing to reduce the surface for adversarial driver manipulation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
