{"api_version":"1","generated_at":"2026-09-04T02:39:37+00:00","cve":"CVE-2026-80565","urls":{"html":"https://cve.report/CVE-2026-80565","api":"https://cve.report/api/cve/CVE-2026-80565.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-80565","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-80565"},"summary":{"title":"crypto: qce - fix error path in devm_qce_register_algs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qce - fix error path in devm_qce_register_algs\n\nIf ops->register_algs() fails, the error path repeatedly calls the same\nops->unregister_algs() from the failed registration. Use the loop index\nto unregister the previously registered algorithms instead.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-26 15:17:11","updated_at":"2026-08-27 06:17:41"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/a134e4b8102c077286818ee112b9f925db613d4c","name":"https://git.kernel.org/stable/c/a134e4b8102c077286818ee112b9f925db613d4c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce","name":"https://git.kernel.org/stable/c/4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9c75402286409f5e1a75e4a445555c84066f89db","name":"https://git.kernel.org/stable/c/9c75402286409f5e1a75e4a445555c84066f89db","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1ece8e16c085e8cd60ecbdb641269aaa53d31da4","name":"https://git.kernel.org/stable/c/1ece8e16c085e8cd60ecbdb641269aaa53d31da4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c7dc487aade12c692add3221673c9bdf32dc24f5","name":"https://git.kernel.org/stable/c/c7dc487aade12c692add3221673c9bdf32dc24f5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fef187c6194d67395182d58169dd14ba631f1b41","name":"https://git.kernel.org/stable/c/fef187c6194d67395182d58169dd14ba631f1b41","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/dbca8b798caf47fb2799a26dd09c9ad66305883d","name":"https://git.kernel.org/stable/c/dbca8b798caf47fb2799a26dd09c9ad66305883d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/de52c713d21806b93b00a6074056b57aec4f8919","name":"https://git.kernel.org/stable/c/de52c713d21806b93b00a6074056b57aec4f8919","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80565","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80565","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9e403fea74ecbe6b4a4321f13bd4bc929382908d dbca8b798caf47fb2799a26dd09c9ad66305883d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f52f00efd8c0088992ac07ef46af6096e4f0e52e fef187c6194d67395182d58169dd14ba631f1b41 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5d5b673b4dd260226b2202f66a920566c27051f3 1ece8e16c085e8cd60ecbdb641269aaa53d31da4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e914b2f795b6995bb0e7db45caa4a912dca09e65 de52c713d21806b93b00a6074056b57aec4f8919 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76e6d50fa5a2fb466edcc8b513d7aad372312c2a c7dc487aade12c692add3221673c9bdf32dc24f5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e80cf84b608725303113d6fe98bb727bf7b7a40d a134e4b8102c077286818ee112b9f925db613d4c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e80cf84b608725303113d6fe98bb727bf7b7a40d 4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e80cf84b608725303113d6fe98bb727bf7b7a40d 9c75402286409f5e1a75e4a445555c84066f89db git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 8c735ef894dfcca8d0a1cc554f83a82a70fd5b76 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4007883dc7df1dbaeb461b850e0b1b27c057affc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.10.235 5.10.266 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.179 5.15.217 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.129 6.1.184 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.78 6.6.153 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.14 6.12.105 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4.291 5.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.13.3 6.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.266 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.217 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.184 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.153 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.105 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.46 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.10 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"80565","cve":"CVE-2026-80565","epss":"0.001200000","percentile":"0.020590000","score_date":"2026-08-27","updated_at":"2026-08-28 00:03:39"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/crypto/qce/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dbca8b798caf47fb2799a26dd09c9ad66305883d","status":"affected","version":"9e403fea74ecbe6b4a4321f13bd4bc929382908d","versionType":"git"},{"lessThan":"fef187c6194d67395182d58169dd14ba631f1b41","status":"affected","version":"f52f00efd8c0088992ac07ef46af6096e4f0e52e","versionType":"git"},{"lessThan":"1ece8e16c085e8cd60ecbdb641269aaa53d31da4","status":"affected","version":"5d5b673b4dd260226b2202f66a920566c27051f3","versionType":"git"},{"lessThan":"de52c713d21806b93b00a6074056b57aec4f8919","status":"affected","version":"e914b2f795b6995bb0e7db45caa4a912dca09e65","versionType":"git"},{"lessThan":"c7dc487aade12c692add3221673c9bdf32dc24f5","status":"affected","version":"76e6d50fa5a2fb466edcc8b513d7aad372312c2a","versionType":"git"},{"lessThan":"a134e4b8102c077286818ee112b9f925db613d4c","status":"affected","version":"e80cf84b608725303113d6fe98bb727bf7b7a40d","versionType":"git"},{"lessThan":"4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce","status":"affected","version":"e80cf84b608725303113d6fe98bb727bf7b7a40d","versionType":"git"},{"lessThan":"9c75402286409f5e1a75e4a445555c84066f89db","status":"affected","version":"e80cf84b608725303113d6fe98bb727bf7b7a40d","versionType":"git"},{"status":"affected","version":"8c735ef894dfcca8d0a1cc554f83a82a70fd5b76","versionType":"git"},{"status":"affected","version":"4007883dc7df1dbaeb461b850e0b1b27c057affc","versionType":"git"},{"lessThan":"5.10.266","status":"affected","version":"5.10.235","versionType":"semver"},{"lessThan":"5.15.217","status":"affected","version":"5.15.179","versionType":"semver"},{"lessThan":"6.1.184","status":"affected","version":"6.1.129","versionType":"semver"},{"lessThan":"6.6.153","status":"affected","version":"6.6.78","versionType":"semver"},{"lessThan":"6.12.105","status":"affected","version":"6.12.14","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.291","versionType":"semver"},{"lessThan":"6.14","status":"affected","version":"6.13.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/crypto/qce/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.266","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.217","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.184","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.153","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.105","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.46","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.266","versionStartIncluding":"5.10.235","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.217","versionStartIncluding":"5.15.179","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.184","versionStartIncluding":"6.1.129","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.153","versionStartIncluding":"6.6.78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.105","versionStartIncluding":"6.12.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.46","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.10","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.291","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qce - fix error path in devm_qce_register_algs\n\nIf ops->register_algs() fails, the error path repeatedly calls the same\nops->unregister_algs() from the failed registration. Use the loop index\nto unregister the previously registered algorithms instead."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in devm_qce_register_algs() called only from qce_crypto_probe() during platform-driver initialization at boot or qcrypto module load, not from any network, ioctl, or AF_ALG userspace path.\nAC:L - On modular builds an attacker can reload qcrypto under memory pressure to force register_algs() failure, and once algorithms leak the UAF is reliably triggered by normal kernel crypto consumers such as fscrypt selecting high-priority QCE transforms.\nPR:L - After the flawed probe error path leaves QCE algorithms registered, unprivileged local processes on Qualcomm phones and embedded targets reach them through routine fscrypt/dm-crypt kernel crypto without capabilities or init-namespace root.\nUI:N - Exploitation requires no victim interaction beyond ordinary encrypted filesystem or storage activity that automatically exercises kernel crypto after the probe failure has occurred.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain, not a VM, IOMMU, or sandbox boundary crossing.\nC:H - Leaked algorithm templates retain tmpl->qce pointers to the devm-freed qce_device, creating a kernel heap use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The dangling qce_device UAF corrupts kernel heap objects and control fields (mutex, DMA, MMIO pointers) reachable from crypto request handlers, enabling arbitrary write and potential code execution.\nA:H - Dereferencing the freed qce_device during QCE crypto operations can cause kernel oops, panic, or hang, and UAF corruption inherently threatens system availability."}]}],"providerMetadata":{"dateUpdated":"2026-08-27T05:01:50.972Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/dbca8b798caf47fb2799a26dd09c9ad66305883d"},{"url":"https://git.kernel.org/stable/c/fef187c6194d67395182d58169dd14ba631f1b41"},{"url":"https://git.kernel.org/stable/c/1ece8e16c085e8cd60ecbdb641269aaa53d31da4"},{"url":"https://git.kernel.org/stable/c/de52c713d21806b93b00a6074056b57aec4f8919"},{"url":"https://git.kernel.org/stable/c/c7dc487aade12c692add3221673c9bdf32dc24f5"},{"url":"https://git.kernel.org/stable/c/a134e4b8102c077286818ee112b9f925db613d4c"},{"url":"https://git.kernel.org/stable/c/4e88b4fda48282f3fd504b4d4f5d2d4f996b76ce"},{"url":"https://git.kernel.org/stable/c/9c75402286409f5e1a75e4a445555c84066f89db"}],"title":"crypto: qce - fix error path in devm_qce_register_algs","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-80565","datePublished":"2026-08-26T14:37:28.953Z","dateReserved":"2026-08-26T14:34:25.767Z","dateUpdated":"2026-08-27T05:01:50.972Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-26 15:17:11","lastModifiedDate":"2026-08-27 06:17:41","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"80565","Ordinal":"1","Title":"crypto: qce - fix error path in devm_qce_register_algs","CVE":"CVE-2026-80565","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"80565","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qce - fix error path in devm_qce_register_algs\n\nIf ops->register_algs() fails, the error path repeatedly calls the same\nops->unregister_algs() from the failed registration. Use the loop index\nto unregister the previously registered algorithms instead.","Type":"Description","Title":"crypto: qce - fix error path in devm_qce_register_algs"}]}}}