CVE-2026-64314 crypto: chacha20poly1305 - validate poly1305 template argument

What is CVE-2026-64314?

CVE-2026-64314 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

crypto: chacha20poly1305 - validate poly1305 template argument

chachapoly_create() still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediately passes it to strcmp().

When the argument is missing, crypto_attr_alg_name() returns an error pointer. Check for that before comparing the name so malformed template instantiations fail with an error instead of dereferencing the error pointer in strcmp().

This matches the surrounding Crypto API template pattern where crypto_attr_alg_name() results are validated before string-specific use.

Weakness: CWE-476

Which versions are affected by CVE-2026-64314?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-64314?

Apply the vendor's patch.

Is CVE-2026-64314 being exploited?

There is no known exploitation of CVE-2026-64314 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2026-64314, DEBIAN-CVE-2026-64314, GHSA-8q9p-r3g4-95mr, ROOT-OS-UBUNTU-2204-CVE-2026-64314, UBUNTU-CVE-2026-64314.