CVE-2026-64313 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
crypto: ecc - Fix carry overflow in vli multiplication
The carry flag calculation fails when r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows.
The condition (r01.m_high < product.m_high) doesn't handle the case where r01.m_high == product.m_high and an additional carry exists from lower-bit overflow.
When commit 3c4b23901a0c ("crypto: ecdh - Add ECDH software support") introduced crypto/ecc.c, it split the muladd() function in the micro-ecc library into separate mul_64_64() and add_128_128() helpers. It seems the check got lost in translation.
Add proper handling for this boundary by accounting for the carry from the lower addition.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability resides in the Linux kernel's cryptographic subsystem, specifically within the elliptic curve cryptography implementation known as ecc. The flaw manifests in the vli multiplication function where carry flag calculation fails under specific saturation conditions. When r01.m_high reaches its maximum value of 0xFFFFFFFFFFFFFFFF and the addition of lower bits produces an overflow, the existing condition fails to properly detect this scenario. The vulnerability stems from a flawed comparison operation that relies on (r01.m_high < product.m_high) without considering the critical edge case where r01.m_high equals product.m_high while still generating an additional carry from the lower-bit operations. This type of arithmetic overflow in cryptographic implementations represents a serious security concern as it can potentially lead to incorrect computations that undermine the integrity of cryptographic operations.
The technical implementation issue originates from a code migration that occurred when commit 3c4b23901a0c introduced the crypto/ecc.c file and refactored the micro-ecc library functions. During this process, the muladd() function was split into separate mul_64_64() and add_128_128() helper functions, which inadvertently caused the carry detection logic to be lost in translation. This demonstrates how seemingly benign refactoring operations can introduce subtle but critical security flaws when mathematical edge cases are not properly preserved during code transformation. The vulnerability specifically affects the ECDH (Elliptic Curve Diffie-Hellman) software implementation, making it particularly concerning for cryptographic key exchange operations that rely on proper elliptic curve arithmetic.
The operational impact of this vulnerability extends beyond simple computational errors to potentially compromise cryptographic security. When carry overflow occurs during elliptic curve multiplications, it can lead to incorrect intermediate calculations that may affect the final cryptographic output. This could enable attackers to exploit the mathematical inconsistency in key generation or signature verification processes, potentially leading to weakened security guarantees. The flaw particularly impacts systems relying on software-based ECC implementations rather than hardware acceleration, making it relevant for embedded systems, virtualized environments, and general-purpose computing platforms where software crypto is utilized.
Mitigation strategies for this vulnerability require patching the kernel with the corrected carry handling logic that properly accounts for lower-bit overflow conditions. System administrators should prioritize updating their Linux kernel versions to include the fix that restores proper carry detection in the vli multiplication function. The solution involves implementing additional boundary checks that consider carry propagation from lower-order bits, ensuring that all edge cases are properly handled during 128-bit arithmetic operations. Organizations should also conduct security assessments of their cryptographic implementations and monitor for potential side-channel effects that might arise from incorrect arithmetic computations. This vulnerability aligns with CWE-191, Integer Underflow/Overflow, and could potentially map to ATT&CK technique T1552.003, "Taint Data: Obfuscated Files or Information," if attackers attempt to exploit the mathematical inconsistencies for further attacks.
The fix addresses fundamental arithmetic principles in cryptographic implementations where proper carry handling is essential for maintaining mathematical correctness. This vulnerability highlights the importance of thorough testing during code refactoring and the critical need for mathematical precision in cryptographic algorithms. The corrected implementation must ensure that all possible carry propagation scenarios are accounted for, particularly when dealing with saturated values in multi-precision arithmetic operations. Such fixes demonstrate the complexity inherent in secure cryptographic implementations where even minor mathematical edge cases can have significant security implications across the entire system.