# crypto: pcrypt - restore callback for non-parallel fallback

CVE record · `CVE-2026-64312`

- **Identifiers:** `CVE-2026-64312`
- **State:** Confirmed
- **Severity:** CVSS 7.5 High
- **Critical:** No
- **CNA:** Linux
- **Weakness (CWE):** [CWE-662](https://cwe.mitre.org/data/definitions/662.html)
- **Tags:** [CWE-662](https://agentprime.io/advisories/tag/cwe-662.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 25 Jul 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 25 Jul 2026, 08:49 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `a92ccd3618e42333ac6f150ecdac14dca298bc7a to before 81ce16d938db9b88cdc231522c0358395ae8c6b5` (git)
  - affected: `96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca to before 3920c5f6edc341729d20d0507e466c6d3b11f372` (git)
  - affected: `92834692a539b5b7f409e467a14667d64713b732 to before ae93c5b3e2a2968b56d772ca1d06615927b7cc36` (git)
  - affected: `5edae7a9a35606017ee6e05911c290acee9fee5a to before 82789a44415e3e31168229421b138278dfb16412` (git)
  - affected: `7ddab756f2de5b7b43c122ebebdf37f400fb2b6f to before 4711ca06bd169a2cbc9cc59a6de2ed512c41a880` (git)
  - affected: `662f2f13e66d3883b9238b0b96b17886179e60e2 to before c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf` (git)
  - affected: `662f2f13e66d3883b9238b0b96b17886179e60e2 to before 83fa1397d5853de1e27dd52ec44b068ff358ca18` (git)
  - affected: `662f2f13e66d3883b9238b0b96b17886179e60e2 to before ed459fe319376e876de433d12b6c6772e612ca36` (git)
  - affected: `dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6` (git)
  - affected: `fca8aed12218f96b38e374ff264d78ea1fbd23cc` (git)
  - affected: `a8e0074ffb38c9a5964a221bb998034d016c93a2` (git)
  - affected: `5.10.231 to before 5.10.261` (semver)
  - and 7 more
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `6.13`
  - unaffected: `before 6.13` (semver)
  - unaffected: `5.10.261 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.212 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.178 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.145 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.96 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.39 to 6.18.*, inclusive` (semver)
  - unaffected: `7.1.4 to 7.1.*, inclusive` (semver)
  - unaffected: `7.2 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.5 High, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0050, the 43rd percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 25 Jul 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-64312](https://www.cve.org/CVERecord?id=CVE-2026-64312)
- [NVD: CVE-2026-64312](https://nvd.nist.gov/vuln/detail/CVE-2026-64312)

### References from the CNA

- <https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5>
- <https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372>
- <https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36>
- <https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412>
- <https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880>
- <https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf>
- <https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18>
- <https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-64312>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-64312/>. Everything for agents: <https://agentprime.io/llms.txt>.