Vulnerability-Lookup

GHSA-5465-F6H2-XR5J

Vulnerability from github – Published: 2026-08-27 06:31 – Updated: 2026-08-27 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

crypto: qce - fix error path in devm_qce_register_algs

If ops->register_algs() fails, the error path repeatedly calls the same ops->unregister_algs() from the failed registration. Use the loop index to unregister the previously registered algorithms instead.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-80565"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-26T15:17:11Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qce - fix error path in devm_qce_register_algs\n\nIf ops-\u003eregister_algs() fails, the error path repeatedly calls the same\nops-\u003eunregister_algs() from the failed registration. Use the loop index\nto unregister the previously registered algorithms instead.",
  "id": "GHSA-5465-f6h2-xr5j",
  "modified": "2026-08-27T06:31:32Z",
  "published": "2026-08-27T06:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80565"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1ece8e16c085e8cd60ecbdb641269aaa53d31da4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9c75402286409f5e1a75e4a445555c84066f89db"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a134e4b8102c077286818ee112b9f925db613d4c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c7dc487aade12c692add3221673c9bdf32dc24f5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dbca8b798caf47fb2799a26dd09c9ad66305883d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/de52c713d21806b93b00a6074056b57aec4f8919"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fef187c6194d67395182d58169dd14ba631f1b41"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-80565 (GCVE-0-2026-80565)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01

Title

crypto: qce - fix error path in devm_qce_register_algs

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devm_qce_register_algs If ops->register_algs() fails, the error path repeatedly calls the same ops->unregister_algs() from the failed registration. Use the loop index to unregister the previously registered algorithms instead.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/dbca8b798caf47fb2…
https://git.kernel.org/stable/c/fef187c6194d67395…
https://git.kernel.org/stable/c/1ece8e16c085e8cd6…
https://git.kernel.org/stable/c/de52c713d21806b93…
https://git.kernel.org/stable/c/c7dc487aade12c692…
https://git.kernel.org/stable/c/a134e4b8102c07728…
https://git.kernel.org/stable/c/4e88b4fda48282f3f…
https://git.kernel.org/stable/c/9c75402286409f5e1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9e403fea74ecbe6b4a4321f13bd4bc929382908d , < dbca8b798caf47fb2799a26dd09c9ad66305883d (git) Affected: f52f00efd8c0088992ac07ef46af6096e4f0e52e , < fef187c6194d67395182d58169dd14ba631f1b41 (git) Affected: 5d5b673b4dd260226b2202f66a920566c27051f3 , < 1ece8e16c085e8cd60ecbdb641269aaa53d31da4 (git) Affected: e914b2f795b6995bb0e7db45caa4a912dca09e65 , < de52c713d21806b93b00a6074056b57aec4f8919 (git) Affected: 76e6d50fa5a2fb466edcc8b513d7aad372312c2a , < c7dc487aade12c692add3221673c9bdf32dc24f5 (git) Affected: e80cf84b608725303113d6fe98bb727bf7b7a40d , < a134e4b8102c077286818ee112b9f925db613d4c (git) Affected: e80cf84b608725303113d6fe98bb727bf7b7a40d , < 4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce (git) Affected: e80cf84b608725303113d6fe98bb727bf7b7a40d , < 9c75402286409f5e1a75e4a445555c84066f89db (git) Affected: 8c735ef894dfcca8d0a1cc554f83a82a70fd5b76 (git) Affected: 4007883dc7df1dbaeb461b850e0b1b27c057affc (git) Affected: 5.10.235 , < 5.10.266 (semver) Affected: 5.15.179 , < 5.15.217 (semver) Affected: 6.1.129 , < 6.1.184 (semver) Affected: 6.6.78 , < 6.6.153 (semver) Affected: 6.12.14 , < 6.12.105 (semver) Affected: 5.4.291 , < 5.5 (semver) Affected: 6.13.3 , < 6.14 (semver)
Linux	Linux	Affected: 6.14 Unaffected: 0 , < 6.14 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/qce/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dbca8b798caf47fb2799a26dd09c9ad66305883d",
              "status": "affected",
              "version": "9e403fea74ecbe6b4a4321f13bd4bc929382908d",
              "versionType": "git"
            },
            {
              "lessThan": "fef187c6194d67395182d58169dd14ba631f1b41",
              "status": "affected",
              "version": "f52f00efd8c0088992ac07ef46af6096e4f0e52e",
              "versionType": "git"
            },
            {
              "lessThan": "1ece8e16c085e8cd60ecbdb641269aaa53d31da4",
              "status": "affected",
              "version": "5d5b673b4dd260226b2202f66a920566c27051f3",
              "versionType": "git"
            },
            {
              "lessThan": "de52c713d21806b93b00a6074056b57aec4f8919",
              "status": "affected",
              "version": "e914b2f795b6995bb0e7db45caa4a912dca09e65",
              "versionType": "git"
            },
            {
              "lessThan": "c7dc487aade12c692add3221673c9bdf32dc24f5",
              "status": "affected",
              "version": "76e6d50fa5a2fb466edcc8b513d7aad372312c2a",
              "versionType": "git"
            },
            {
              "lessThan": "a134e4b8102c077286818ee112b9f925db613d4c",
              "status": "affected",
              "version": "e80cf84b608725303113d6fe98bb727bf7b7a40d",
              "versionType": "git"
            },
            {
              "lessThan": "4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce",
              "status": "affected",
              "version": "e80cf84b608725303113d6fe98bb727bf7b7a40d",
              "versionType": "git"
            },
            {
              "lessThan": "9c75402286409f5e1a75e4a445555c84066f89db",
              "status": "affected",
              "version": "e80cf84b608725303113d6fe98bb727bf7b7a40d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8c735ef894dfcca8d0a1cc554f83a82a70fd5b76",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4007883dc7df1dbaeb461b850e0b1b27c057affc",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.266",
              "status": "affected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.217",
              "status": "affected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.184",
              "status": "affected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.153",
              "status": "affected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.105",
              "status": "affected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/qce/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.10.235",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15.179",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1.129",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.6.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.12.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.291",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qce - fix error path in devm_qce_register_algs\n\nIf ops-\u003eregister_algs() fails, the error path repeatedly calls the same\nops-\u003eunregister_algs() from the failed registration. Use the loop index\nto unregister the previously registered algorithms instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in devm_qce_register_algs() called only from qce_crypto_probe() during platform-driver initialization at boot or qcrypto module load, not from any network, ioctl, or AF_ALG userspace path.\nAC:L - On modular builds an attacker can reload qcrypto under memory pressure to force register_algs() failure, and once algorithms leak the UAF is reliably triggered by normal kernel crypto consumers such as fscrypt selecting high-priority QCE transforms.\nPR:L - After the flawed probe error path leaves QCE algorithms registered, unprivileged local processes on Qualcomm phones and embedded targets reach them through routine fscrypt/dm-crypt kernel crypto without capabilities or init-namespace root.\nUI:N - Exploitation requires no victim interaction beyond ordinary encrypted filesystem or storage activity that automatically exercises kernel crypto after the probe failure has occurred.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain, not a VM, IOMMU, or sandbox boundary crossing.\nC:H - Leaked algorithm templates retain tmpl-\u003eqce pointers to the devm-freed qce_device, creating a kernel heap use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The dangling qce_device UAF corrupts kernel heap objects and control fields (mutex, DMA, MMIO pointers) reachable from crypto request handlers, enabling arbitrary write and potential code execution.\nA:H - Dereferencing the freed qce_device during QCE crypto operations can cause kernel oops, panic, or hang, and UAF corruption inherently threatens system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:50.972Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dbca8b798caf47fb2799a26dd09c9ad66305883d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fef187c6194d67395182d58169dd14ba631f1b41"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ece8e16c085e8cd60ecbdb641269aaa53d31da4"
        },
        {
          "url": "https://git.kernel.org/stable/c/de52c713d21806b93b00a6074056b57aec4f8919"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7dc487aade12c692add3221673c9bdf32dc24f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a134e4b8102c077286818ee112b9f925db613d4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c75402286409f5e1a75e4a445555c84066f89db"
        }
      ],
      "title": "crypto: qce - fix error path in devm_qce_register_algs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80565",
    "datePublished": "2026-08-26T14:37:28.953Z",
    "dateReserved": "2026-08-26T14:34:25.767Z",
    "dateUpdated": "2026-08-27T05:01:50.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-5465-F6H2-XR5J

CVE-2026-80565 (GCVE-0-2026-80565)

Tags

Sightings

Nomenclature