In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() returns -EBUSY, pcrypt falls back to calling the child AEAD directly. That fallback must not keep the padata completion callback. Otherwise an asynchronous completion runs pcrypt_aead_done() even though the request was never enrolled in padata. Restore the original request callback and callback data before calling the child AEAD directly. This keeps the fallback path aligned with a direct AEAD request while leaving the parallel path unchanged.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64312 is a logic flaw in the Linux kernel's pcrypt (parallel crypto) module where incorrect callback handling during fallback operations causes asynchronous completion handlers to execute in unintended contexts. When padata_do_parallel() returns -EBUSY, pcrypt falls back to direct AEAD (Authenticated Encryption with Associated Data) invocation but fails to restore the original callback, leaving the padata completion handler in place. This causes pcrypt_aead_done() to run even though the request was never properly enrolled in the padata queue, leading to memory corruption, use-after-free conditions, or privilege escalation on affected Linux systems. The vulnerability impacts any system using hardware-accelerated cryptographic operations or parallel crypto processing, particularly in cloud environments and containerized workloads relying on kernel crypto APIs.
While this CVE lacks explicit MITRE ATT&CK technique mappings, Casky's extended reasoning capabilities would detect attack patterns associated with Privilege Escalation (T1548), Exploitation of Vulnerability (T1190), and Execution (T1559) by analyzing kernel memory safety violations. Practitioners using Casky would identify this vulnerability through detection of: (1) unexpected callback invocations in kernel crypto subsystem logs, (2) memory access violations in pcrypt module traces, (3) timing anomalies in cryptographic operation completions, and (4) state machine inconsistencies in padata queue management. By correlating these signals with MITRE techniques related to kernel exploitation, Casky helps security teams prioritize patching of cryptographic infrastructure and implement monitoring rules to detect exploitation attempts targeting crypto callback corruption.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64312. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation