CVE-2026-64544 with CVSS Score: 6.5 is a vulnerability affecting the Linux kernel crypto subsystem, specifically within the asymmetric keys module. This issue involves an out-of-bounds (OOB) read flaw in the pefile_digest_pe_contents function, which occurs during the parsing of PE file contents. The vulnerability arises when the software reads data beyond the expected boundary of a buffer, potentially allowing an attacker to access sensitive information stored in memory. To exploit this flaw, an attacker would typically require the ability to trigger the parsing of a maliciously crafted PE file, often requiring local access or specific user interaction depending on the system configuration. Successful exploitation could result in the disclosure of kernel memory addresses or sensitive data, leading to information disclosure or system crashes. The business impact includes potential compromise of system integrity and stability, as attackers could leverage leaked information to bypass security controls such as Address Space Layout Randomization (ASLR) or cause denial-of-service conditions. Exploitation depends on the affected system processing a malformed PE file through the vulnerable cryptographic component, potentially impacting environments that rely on kernel module signature verification.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-64544 with CVSS Score: 6.5 is a vulnerability affecting the Linux kernel crypto subsystem, specifically within the asymmetric keys module. This issue involves an out-of-bounds (OOB) read flaw in the pefile_digest_pe_contents function, which occurs during the parsing of PE file contents. The vulnerability arises when the software reads data beyond the expected boundary of a buffer, potentially allowing an attacker to access sensitive information stored in memory. To exploit this flaw, an attacker would typically require the ability to trigger the parsing of a maliciously crafted PE file, often requiring local access or specific user interaction depending on the system configuration. Successful exploitation could result in the disclosure of kernel memory addresses or sensitive data, leading to information disclosure or system crashes. The business impact includes potential compromise of system integrity and stability, as attackers could leverage leaked information to bypass security controls such as Address Space Layout Randomization (ASLR) or cause denial-of-service conditions. Exploitation depends on the affected system processing a malformed PE file through the vulnerable cryptographic component, potentially impacting environments that rely on kernel module signature verification.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]