CVE-2026-64314: crypto: chacha20poly1305 - validate poly1305 template argument

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

crypto: chacha20poly1305 - validate poly1305 template argument

chachapoly_create() still accepts the compatibility poly1305 parameter
in the template name, but it assumes the second template argument is
always present and immediately passes it to strcmp().

When the argument is missing, crypto_attr_alg_name() returns an error
pointer. Check for that before comparing the name so malformed template
instantiations fail with an error instead of dereferencing the error
pointer in strcmp().

This matches the surrounding Crypto API template pattern where
crypto_attr_alg_name() results are validated before string-specific use.

The Linux kernel CVE team has assigned CVE-2026-64314 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.16 with commit a298765e28adaea199f722142c10dae7e24dedf8 and fixed in 6.18.39 with commit 0016d3c21c6ab60a20be7f565cefb5999f3adeb6
	Issue introduced in 6.16 with commit a298765e28adaea199f722142c10dae7e24dedf8 and fixed in 7.1.4 with commit e74df53b36cdc6b6b9e5488ec883d1d55624737f
	Issue introduced in 6.16 with commit a298765e28adaea199f722142c10dae7e24dedf8 and fixed in 7.2-rc1 with commit 265b861bece38318b8e0fc8fac0643d4ef906d31

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64314
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	crypto/chacha20poly1305.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0016d3c21c6ab60a20be7f565cefb5999f3adeb6
	https://git.kernel.org/stable/c/e74df53b36cdc6b6b9e5488ec883d1d55624737f
	https://git.kernel.org/stable/c/265b861bece38318b8e0fc8fac0643d4ef906d31