CVE-2026-64313

A flaw was found in the Linux kernel's Elliptic Curve Cryptography (ECC) component. An attacker on an adjacent network could exploit an error in the very long integer (vli) multiplication's carry flag calculation. This mathematical inaccuracy in cryptographic operations could lead to high impact on confidentiality, integrity, and availability.

This flaw is rated as Moderate impact for Red Hat Enterprise Linux because triggering the overflow requires precise boundary condition inputs during software-based elliptic curve operations, limiting general exploitability. While the flaw stems from an arithmetic handling error during large integer multiplication within the kernel cryptographic subsystem, typical enterprise environments do not directly expose these internal operations to unauthenticated external users. Consequently, the primary operational threat is restricted to localized computational anomalies or service disruption under uncommon edge-case values rather than arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.