Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffers

Impact

The generic RSA key parser bounds each CRT component (p, q, dp, dq, qinv) by the full modulus size, but qat_rsa_setkey_crt() allocates DMA buffers of key_sz/2 and right-aligns each component with memcpy(dst + half_key_sz - len, src, len). A component longer than half the modulus underflows the offset and writes outside the DMA buffer. The overflowing bytes come from a key the caller supplies, so the content is attacker-chosen, not incidental. On nodes where Intel QuickAssist is enabled for TLS termination or storage compression in front of a GPU fleet, that is kernel heap and DMA-mapped memory corruption from a key-set operation - local privilege escalation or a node crash. Nodes without a bound QAT device are unaffected.

Who can reach it

Local user on a host with the qat driver loaded and bound to a QuickAssist device, able to install an RSA private key on the qat akcipher transform - reachable through AF_ALG from an unprivileged process on default configurations. The record describes no network-facing path.

What to do

Update to a stable kernel carrying the length checks (commits linked in the record) and reboot each affected node; drain GPU workloads first. If crypto offload is not actually in use on a node, unbinding or blacklisting the qat modules removes the exposure without waiting for the kernel update. The record names no vendor advisory beyond the upstream commits and no non-kernel fixed version.

References

Related entries

• Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entriesCVE-2026-64305 · Linux kernel Intel QAT driver (adf service_table list locking)High
• Linux kernel BPF: LPM trie RCU annotations reject sleepable programs and spam lockdep warningsCVE-2026-64352 · Linux kernel BPF LPM trie (RCU annotations for sleepable programs)High
• Linux BPF: BTF repeated-field count overflow allows an out-of-bounds write on BPF_BTF_LOADCVE-2026-64354 · Linux kernel BPF BTF parser (btf_repeat_fields expansion)High
• Linux mm: shrinker_info teardown races with expansion, giving a double free of memcg shrinker mapsCVE-2026-64418 · Linux kernel memcg shrinker_info (alloc/teardown race with expand_shrinker_info)High
• Linux kernel perf/core: remove_on_exec leaves stale group state, corrupting the PMU active listCVE-2026-64556 · Linux kernel perf/core (perf_event_remove_on_exec group detach)High
• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High