Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffers

Impact

The generic RSA key parser bounds each CRT component (p, q, dp, dq, qinv) by the full modulus size, but qat_rsa_setkey_crt() allocates DMA buffers of key_sz/2 and right-aligns each component with memcpy(dst + half_key_sz - len, src, len). A component longer than half the modulus underflows the offset and writes outside the DMA buffer. The overflowing bytes come from a key the caller supplies, so the content is attacker-chosen, not incidental. On nodes where Intel QuickAssist is enabled for TLS termination or storage compression in front of a GPU fleet, that is kernel heap and DMA-mapped memory corruption from a key-set operation - local privilege escalation or a node crash. Nodes without a bound QAT device are unaffected.

Who can reach it

Local user on a host with the qat driver loaded and bound to a QuickAssist device, able to install an RSA private key on the qat akcipher transform - reachable through AF_ALG from an unprivileged process on default configurations. The record describes no network-facing path.

What to do

Update to a stable kernel carrying the length checks (commits linked in the record) and reboot each affected node; drain GPU workloads first. If crypto offload is not actually in use on a node, unbinding or blacklisting the qat modules removes the exposure without waiting for the kernel update. The record names no vendor advisory beyond the upstream commits and no non-kernel fixed version.

References

Related entries

• Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entriesCVE-2026-64305 · Linux kernel Intel QAT driver (adf service_table list locking)High
• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel iomap: zero-length write range underflows into an out-of-bounds bitmap_set()CVE-2026-68145 · Linux kernel iomap (ifs_set_range_dirty / ifs_set_range_uptodate)High
• Linux kernel libceph: use-after-free reading the monmap debugfs file during client teardownCVE-2026-68153 · Linux kernel libceph (per-client debugfs files vs client teardown)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-68257 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High