Linux kernel chacha20poly1305 template: missing argument check dereferences an error pointer

Impact

chachapoly_create() accepts the legacy poly1305 template parameter and assumes the second template argument is present, passing whatever crypto_attr_alg_name() returns straight to strcmp(). When the argument is missing that return value is an error pointer, and the string compare dereferences it - a kernel oops on the instantiation path. The practical exposure is a local user who can ask the crypto API to instantiate a malformed template name; on a host with CONFIG_CRYPTO_USER_API_AEAD that includes an unprivileged process inside a container via an AF_ALG socket, unless seccomp or the runtime profile blocks that socket family. The consequence is a crashed or oopsing host kernel, which on a GPU node means an unplanned loss of every co-tenant job on the box, not just the caller's. The record does not confirm the AF_ALG path, so verify whether your runtime profile permits AF_ALG before rating this as tenant-reachable.

Who can reach it

Local user able to request instantiation of a crypto algorithm by name. On hosts exposing AF_ALG to containers, that is any tenant with a GPU pod; otherwise it requires a local process on the host. No privilege beyond opening the socket is described.

What to do

Take the stable kernel update with the fix and reboot the node - kernel crypto template code cannot be reloaded under running workloads. Schedule this into the normal rolling drain-and-reboot rather than an emergency window, since the outcome is a crash rather than a compromise. As an interim mitigation, block AF_ALG in the container seccomp profile if your workloads do not need the userspace crypto API; that also removes a broad class of similar template-parsing bugs.

References

Related entries

• Linux kernel BPF verifier: map-in-map lookup nullness elided using the wrong max_entriesCVE-2026-64353 · Linux kernel BPF verifier (ARRAY_OF_MAPS with BPF_F_INNER_MAP inner arrays)Medium
• Linux kernel (drivers/vfio/pci): The disable_idle_d3 power-management flag was a module-wide global that could changeCVE-2026-64476 · Linux kernel (drivers/vfio/pci)Medium
• Linux kernel (drivers/iommu/intel): SVA bind and unbind are asymmetric on VT-d hardware without PCI/PRI - bind skipsCVE-2026-64591 · Linux kernel (drivers/iommu/intel)Medium
• Linux kernel (arch/x86/kvm/vmx): When a nested VM-Enter fails on invalid guest state, KVM took an open-coded exit pathCVE-2026-68081 · Linux kernel (arch/x86/kvm/vmx)Medium
• AMD SEV-ES (CacheWarp): CacheWarp: INVD lets a malicious hypervisor revert SEV-ES guest memory writes, breaking guestCVE-2023-20592 · AMD SEV-ES (CacheWarp)Medium
• Linux kernel (drivers/pci): When the kernel coalesces two adjacent host-bridge apertures it invalidates the absorbedCVE-2023-53814 · Linux kernel (drivers/pci)Medium