In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size DMA buffers (key_sz / 2) and right-aligns each component with: memcpy(dst + half_key_sz - len, src, len) When a CRT component is larger than half_key_sz the subtraction underflows and memcpy writes past the DMA buffer, causing memory corruption. Add a len > half_key_sz check next to the existing !len check for each of the five CRT components so the driver falls back to the non-CRT path instead of writing out of bounds.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64304 is a buffer overflow vulnerability in the Linux kernel's QAT (QuickAssist Technology) cryptographic driver affecting RSA key handling. The vulnerability exists in qat_rsa_setkey_crt() where CRT (Chinese Remainder Theorem) components are validated against the full modulus size but copied into half-sized DMA buffers. When RSA key components (p, q, dp, dq, qinv) exceed half the key size, integer underflow in the memcpy offset calculation causes out-of-bounds writes, potentially corrupting adjacent memory. This affects systems using Intel QAT accelerators for cryptographic operations, particularly in cloud infrastructure, VPN gateways, and high-performance security appliances that process untrusted RSA keys.
Casky.ai's Claude-powered analysis would identify this vulnerability through detection of memory safety anomalies and cryptographic implementation flaws, mapping to MITRE ATT&CK T1203 (Exploitation for Privilege Escalation) and T1040 (Traffic Capture) patterns where attackers exploit kernel memory corruption to gain elevated access or compromise cryptographic operations. Practitioners using Casky would observe findings highlighting unsafe buffer management in device driver code, unchecked arithmetic operations leading to memory corruption, and exploitation chains where malformed RSA keys serve as attack vectors. The platform would flag the disconnect between input validation (full modulus-size checks) and output buffer allocation (half-size buffers) as a critical control gap, enabling teams to identify vulnerable QAT driver versions and implement targeted patching or disable hardware acceleration where necessary.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64304. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation