CVE-2026-64312

A flaw was found in the Linux kernel's parallel cryptography (pcrypt) subsystem. When the system falls back to a non-parallel processing path, it fails to properly restore the original callback function and data. This oversight can lead to an asynchronous completion running an incorrect callback, potentially causing unexpected system behavior or resource management issues. This vulnerability could be exploited by a local attacker to disrupt system operations.

A callback confusion bug exists in crypto pcrypt when padata_do_parallel returns EBUSY and the code falls back to direct AEAD execution. The child AEAD request can still carry the pcrypt_aead_done callback even though the request was never enrolled in padata, so an asynchronous completion can run padata completion logic on an invalid request state. For the CVSS the PR:L is used because a local user or local process generally needs access to a pcrypt backed crypto interface or to a configured kernel consumer of this algorithm. The issue is not directly network reachable from the patch context, although network triggered use may be possible only if a system already routes attacker controlled traffic through a pcrypt based kernel crypto consumer. Impact is at least a local denial of service via crash, warning, or broken crypto request completion. In the paranoid interpretation, the callback and padata state mismatch is treated as a plausible memory lifetime or list state corruption candidate, so confidentiality and integrity impact should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.