CVE-2026-64544: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

pefile_digest_pe_contents() computes the trailing-data hash length as
pelen - (hashed_bytes + certs_size). A crafted PE can make the addition
exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.
This is passed to crypto_shash_update() which reads out of bounds and
panics on unmapped vmalloc guard pages.

 BUG: unable to handle page fault for address: ffffc900038d8000
 Oops: Oops: 0000 [#1] SMP KASAN NOPTI
 RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)
 Call Trace:
  <TASK>
  __sha256_update (lib/crypto/sha256.c:208)
  crypto_sha256_update (crypto/sha256.c:142)
  verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)
  kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)
  __do_sys_kexec_file_load (kernel/kexec_file.c:406)
  do_syscall_64 (arch/x86/entry/syscall_64.c:94)
  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
  </TASK>
 Kernel panic - not syncing: Fatal exception

Validate that the addition does not overflow and the result does not
exceed pelen before the subtraction. Return -ELIBBAD on failure.

The Linux kernel CVE team has assigned CVE-2026-64544 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.17 with commit af316fc442ef23901bbfcec5af55e69ca6ce9563 and fixed in 5.10.261 with commit 89efd998470a93284b7ad5a20d4e0e3c6858ae8e
	Issue introduced in 3.17 with commit af316fc442ef23901bbfcec5af55e69ca6ce9563 and fixed in 5.15.212 with commit 7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c
	Issue introduced in 3.17 with commit af316fc442ef23901bbfcec5af55e69ca6ce9563 and fixed in 6.1.178 with commit b798ada5a5d1cb4cc4cfa72074b1b463eca6c506
	Issue introduced in 3.17 with commit af316fc442ef23901bbfcec5af55e69ca6ce9563 and fixed in 6.6.145 with commit 627938383761fb4334b41ebe7ef438d6b8b19d60
	Issue introduced in 3.17 with commit af316fc442ef23901bbfcec5af55e69ca6ce9563 and fixed in 6.12.97 with commit e162bc386e71b5412425a38ee048e8d2185491b9
	Issue introduced in 3.17 with commit af316fc442ef23901bbfcec5af55e69ca6ce9563 and fixed in 6.18.40 with commit 6acd2fbd00f9c72aebefce63fc2e73e8f3d79061
	Issue introduced in 3.17 with commit af316fc442ef23901bbfcec5af55e69ca6ce9563 and fixed in 7.1.5 with commit 803591785d33cf13b6f73ce2796e8b9e6d5e6526
	Issue introduced in 3.17 with commit af316fc442ef23901bbfcec5af55e69ca6ce9563 and fixed in 7.2-rc1 with commit f7dd32c5179d7755de18e21d5674b08f9e5cb180

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64544
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	crypto/asymmetric_keys/verify_pefile.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/89efd998470a93284b7ad5a20d4e0e3c6858ae8e
	https://git.kernel.org/stable/c/7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c
	https://git.kernel.org/stable/c/b798ada5a5d1cb4cc4cfa72074b1b463eca6c506
	https://git.kernel.org/stable/c/627938383761fb4334b41ebe7ef438d6b8b19d60
	https://git.kernel.org/stable/c/e162bc386e71b5412425a38ee048e8d2185491b9
	https://git.kernel.org/stable/c/6acd2fbd00f9c72aebefce63fc2e73e8f3d79061
	https://git.kernel.org/stable/c/803591785d33cf13b6f73ce2796e8b9e6d5e6526
	https://git.kernel.org/stable/c/f7dd32c5179d7755de18e21d5674b08f9e5cb180