{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64313", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.779Z", "datePublished": "2026-07-25T08:49:44.546Z", "dateUpdated": "2026-07-27T04:59:40.630Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-27T04:59:40.630Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ecc - Fix carry overflow in vli multiplication\n\nThe carry flag calculation fails when r01.m_high is saturated\n(0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows.\n\nThe condition (r01.m_high < product.m_high) doesn't handle the case\nwhere r01.m_high == product.m_high and an additional carry exists\nfrom lower-bit overflow.\n\nWhen commit 3c4b23901a0c (\"crypto: ecdh - Add ECDH software support\")\nintroduced crypto/ecc.c, it split the muladd() function in the\nmicro-ecc library into separate mul_64_64() and add_128_128() helpers.\nIt seems the check got lost in translation.\n\nAdd proper handling for this boundary by accounting for the carry\nfrom the lower addition."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/ecc.c"], "versions": [{"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2", "lessThan": "d11b2bb99bec1f5557c01cac42231e23745f49b8", "status": "affected", "versionType": "git"}, {"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2", "lessThan": "b709e0e768766abe29a49e1c1922a1604be602f4", "status": "affected", "versionType": "git"}, {"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2", "lessThan": "24a54dfa06d09813b4802a374fad3d2c0e16a884", "status": "affected", "versionType": "git"}, {"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2", "lessThan": "677450e5ef850c4d28b7956aa01104548c2a894e", "status": "affected", "versionType": "git"}, {"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2", "lessThan": "5275e0fca256d081e2e7d4ba3dd8216c6e50d44e", "status": "affected", "versionType": "git"}, {"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2", "lessThan": "774ddddf5eb26eeca177350413e3e2bc50930ee9", "status": "affected", "versionType": "git"}, {"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2", "lessThan": "ebaae7c4251cc0cdb2602f334d4f08a3e82d271e", "status": "affected", "versionType": "git"}, {"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2", "lessThan": "27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/ecc.c"], "versions": [{"version": "4.8", "status": "affected"}, {"version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d11b2bb99bec1f5557c01cac42231e23745f49b8"}, {"url": "https://git.kernel.org/stable/c/b709e0e768766abe29a49e1c1922a1604be602f4"}, {"url": "https://git.kernel.org/stable/c/24a54dfa06d09813b4802a374fad3d2c0e16a884"}, {"url": "https://git.kernel.org/stable/c/677450e5ef850c4d28b7956aa01104548c2a894e"}, {"url": "https://git.kernel.org/stable/c/5275e0fca256d081e2e7d4ba3dd8216c6e50d44e"}, {"url": "https://git.kernel.org/stable/c/774ddddf5eb26eeca177350413e3e2bc50930ee9"}, {"url": "https://git.kernel.org/stable/c/ebaae7c4251cc0cdb2602f334d4f08a3e82d271e"}, {"url": "https://git.kernel.org/stable/c/27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406"}], "title": "crypto: ecc - Fix carry overflow in vli multiplication", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: crypto: ecc - Fix carry overflow in vli multiplication", "id": "2507085", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507085"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in the Linux kernel's Elliptic Curve Cryptography (ECC) component. An attacker on an adjacent network could exploit an error in the very long integer (vli) multiplication's carry flag calculation. This mathematical inaccuracy in cryptographic operations could lead to high impact on confidentiality, integrity, and availability."], "name": "CVE-2026-64313", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64313\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64313\nhttps://lore.kernel.org/linux-cve-announce/2026072509-CVE-2026-64313-1119@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4b23901a0c766879dff680cd6bdab47bcdbbd2,d11b2bb99bec1f5557c01cac42231e23745f49b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4b23901a0c766879dff680cd6bdab47bcdbbd2,b709e0e768766abe29a49e1c1922a1604be602f4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4b23901a0c766879dff680cd6bdab47bcdbbd2,24a54dfa06d09813b4802a374fad3d2c0e16a884)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4b23901a0c766879dff680cd6bdab47bcdbbd2,677450e5ef850c4d28b7956aa01104548c2a894e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4b23901a0c766879dff680cd6bdab47bcdbbd2,5275e0fca256d081e2e7d4ba3dd8216c6e50d44e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4b23901a0c766879dff680cd6bdab47bcdbbd2,774ddddf5eb26eeca177350413e3e2bc50930ee9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4b23901a0c766879dff680cd6bdab47bcdbbd2,ebaae7c4251cc0cdb2602f334d4f08a3e82d271e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c4b23901a0c766879dff680cd6bdab47bcdbbd2,27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.261,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.212,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.178,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.145,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.96,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.39,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.4,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T13:15:03.774005+00:00", "updated": "2026-07-30T04:00:05.697505+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-190"]}