{"cve":"CVE-2026-64312","nvd":{"published":"2026-07-25T10:17:12.373","modified":"2026-10-24T13:10:00.147","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata.  If padata_do_parallel() returns\n-EBUSY, pcrypt falls back to calling the child AEAD directly.\n\nThat fallback must not keep the padata completion callback.  Otherwise\nan asynchronous completion runs pcrypt_aead_done() even though the\nrequest was never enrolled in padata.\n\nRestore the original request callback and callback data before calling\nthe child AEAD directly.  This keeps the fallback path aligned with a\ndirect AEAD request while leaving the parallel path unchanged.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-662"],"references":["https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372","https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880","https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5","https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412","https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-24T16:53:27.712498749+00:00"},"epss":{"cve":"CVE-2026-64312","score":0.00501,"percentile":0.42626,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}