Description

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devm_qce_register_algs If ops->register_algs() fails, the error path repeatedly calls the same ops->unregister_algs() from the failed registration. Use the loop index to unregister the previously registered algorithms instead.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:11.550Z",
  "pubdate": "2026-08-26T15:17:11.550Z",
  "executiveSummary": "The vulnerability resides within the Qualcomm Cryptographic Engine (qce) driver of the Linux kernel, specifically affecting the algorithm registration error path in devm_qce_register_algs.\nThe flaw is categorized as an improper error handling issue leading to a potential resource management failure or system instability.\nWhen the registration of cryptographic algorithms fails, the driver's cleanup mechanism incorrectly invokes the unregistration function for all previously registered algorithms, including those that failed to register or were never successfully initialized.\nThis logic error can result in kernel-level memory corruption or invalid operations on data structures during driver probe failure, potentially impacting system stability.\nThe vulnerability does not require network access as it occurs during kernel module initialization, typically requiring local access to the system with sufficient privileges to trigger the loading of the qce driver or probe execution.\nSuccessful exploitation depends on the kernel's memory management state and the specific failure mode during the registration process, potentially leading to a kernel panic or unpredictable system state.",
  "technicalDetails": "The root cause of this vulnerability is a flawed loop logic within the devm_qce_register_algs function in the Linux kernel's qce cryptographic driver.\nDuring the initialization phase, the driver iterates through a set of algorithm descriptors to register them with the kernel's cryptographic subsystem. The implementation of the error handling path in the event of an algorithm registration failure was incorrectly scoped.\nUpon the failure of an ops->register_algs() call, the driver attempts to perform a rollback of previously registered algorithms. However, the existing implementation failed to track the specific progress of the registration loop accurately. Instead of utilizing the current loop index to identify and unregister only the algorithms that had successfully completed their registration sequence, the error path initiated unregistration calls across the entire set or incorrectly referenced the failed pointer.\nThis results in a 'use-after-free' scenario or an 'invalid unregistration' scenario where the kernel attempts to free resources associated with algorithms that were never successfully initialized or were not part of the active registration set at the point of failure.\nThe attack flow requires an environment where the qce driver probe can be induced to fail during its registration loop. An attacker with the ability to influence kernel module loading or system hardware configuration could potentially force a failure condition that triggers this flawed error path.\nThe exploit process involves: 1. Initiating the loading of the qce driver. 2. Inducing a failure in the algorithm registration sequence (e.g., through hardware resource exhaustion or conflicting algorithm registration). 3. Triggering the erroneous devm_qce_register_algs error path, which causes the kernel to execute cleanup operations on uninitialized or improper pointers. 4. Observing or manipulating the resulting kernel crash or memory corruption.\nPost-exploitation, the primary impact is a kernel panic, resulting in a Denial of Service (DoS) for the host system. While there is no direct evidence of remote code execution, the memory corruption primitives generated by the improper cleanup logic could potentially be leveraged for further kernel exploitation depending on the architectural defenses, such as KASLR or SMEP, currently active on the target platform."
}