CVE-2026-64599

HIGHPre-NVD 7.87.8—
EchelonGraph scoreHIGH confidence

Score 7.8 from GitHub Security Advisory (severity: HIGH) published 2026-08-06. a secondary CVSS source baseline 7.8; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, secondary
Trending — 3 sources updated this week
7.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 7.8Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

crypto: amlogic - avoid double cleanup in meson_crypto_probe()

When meson_allocate_chanlist() fails after a partial allocation, it already unwinds the allocated chanlist state through its local error path. meson_crypto_probe() then jump to error_flow and calls meson_free_chanlist() again, causing the same per-flow resources to be torn down twice. In the reproduced failure path, the second teardown re-entered crypto_engine_exit() on an already destroyed worker and KASAN reported a slab-use-after-free in kthread_destroy_worker().

Prevent double-free by handling partial allocation failures locally within meson_allocate_chanlist() and skipping the outer cleanup path.

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available.

The bug was reproduced in a QEMU x86_64 guest booted with KASAN on v7.1, using the reproducer under tools/testing/meson_crypto_probe. The reproducer forces the second dma_alloc_attrs() call in the gxl-crypto probe path to return NULL, making meson_allocate_chanlist() fail after partial initialization. On the unpatched kernel this reliably triggered a slab-use-after-free. With this fix applied, the same reproducer no longer emits any KASAN report and the probe fails cleanly with -ENOMEM.

================================================================== BUG: KASAN: slab-use-after-free in kthread_destroy_worker+0xb2/0xd0 Read of size 8 at addr ff1100010c057a68 by task insmod/265

CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G O 7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy) Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x68/0xa0 print_report+0xcb/0x5e0 ? __virt_addr_valid+0x21d/0x3f0 ? kthread_destroy_worker+0xb2/0xd0 ? kthread_destroy_worker+0xb2/0xd0 kasan_report+0xca/0x100 ? kthread_destroy_worker+0xb2/0xd0 kthread_destroy_worker+0xb2/0xd0 meson_crypto_probe+0x4d0/0xc10 [amlogic_gxl_crypto] platform_probe+0x99/0x140 really_probe+0x1c6/0x6a0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x248/0x310 ? acpi_driver_match_device+0xb0/0x100 driver_probe_device+0x48/0x210 ? __pfx___device_attach_driver+0x10/0x10 __device_attach_driver+0x160/0x320 bus_for_each_drv+0x104/0x190 ? __pfx_bus_for_each_drv+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x2c/0x50 __device_attach+0x19d/0x3b0 ? __pfx___device_attach+0x10/0x10 ? do_raw_spin_unlock+0x53/0x220 device_initial_probe+0x78/0xa0 bus_probe_device+0x5b/0x130 device_add+0xcfd/0x1430 ? __pfx_device_add+0x10/0x10 ? insert_resource+0x34/0x50 ? lock_release+0xc9/0x290 platform_device_add+0x24e/0x590 ? __pfx_meson_crypto_probe_repro_init+0x10/0x10 [meson_crypto_probe_repro] meson_crypto_probe_repro_init+0x330/0xff0 [meson_crypto_probe_repro] do_one_initcall+0xc0/0x450 ? __pfx_do_one_initcall+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x2c/0x50 ? __create_object+0x59/0x80 ? kasan_unpoison+0x27/0x60 do_init_module+0x27b/0x7d0 ? __pfx_do_init_module+0x10/0x10 ? kasan_quarantine_put+0x84/0x1d0 ? kfree+0x32c/0x510 ? load_module+0x561e/0x5ff0 load_module+0x54fe/0x5ff0 ? __pfx_load_module+0x10/0x10 ? security_file_permission+0x20/0x40 ? kernel_read_file+0x23d/0x6e0 ? mmap_region+0x235/0x4a0 ? __pfx_kernel_read_file+0x10/0x10 ? __file_has_perm+0x2c0/0x3e0 init_module_from_file+0x158/0x180 ? __pfx_init_module_from_file+0x10/0x10 ? __lock_acquire+0x45a/0x1ba0 ? idempotent_init_module+0x315/0x610 ? lock_release+0xc9/0x290 ? lock ---truncated---

CVSS v3
7.8
EG Score
7.8(high)
EG Risk
40(Track)
EG Risk 40/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity78% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
2%
KEV
Not listed

Published

August 6, 2026

Last Modified

August 17, 2026

Advisory Details (8)

Auto-updated Aug 8, 2026
No patch confirmed yet.
generic

crypto: amlogic - avoid double cleanup in meson_crypto_probe() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/f30e2b879bda14bc3e1524fba6f8ab9ec119da90
generic

crypto: amlogic - avoid double cleanup in meson_crypto_probe() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/c80360b4e85099fc3835378a96a59c0a2480fb07
generic

crypto: amlogic - avoid double cleanup in meson_crypto_probe() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/c2c48aa7a6be36d4c93da75d14d4b4f2f4168c81
generic

crypto: amlogic - avoid double cleanup in meson_crypto_probe() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/84a00be9b736aa5dce902a290f62cbbbdcfab9ed
generic

crypto: amlogic - avoid double cleanup in meson_crypto_probe() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/6effdbaca3cd8354540bdf42c7f5fb84412afeb7
generic

crypto: amlogic - avoid double cleanup in meson_crypto_probe() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/6dda8406d8a3da2519c8b388d443d7357839cb63
generic

crypto: amlogic - avoid double cleanup in meson_crypto_probe() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/6d827ade51a24e18d81afb9f32756d339520a14c
generic

crypto: amlogic - avoid double cleanup in meson_crypto_probe() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/5b452019a4127f63c1f2147237fc287d1581f606

Vendor Advisories for CVE-2026-64599(2)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(5 across 4 ecosystems)
Debian:12(2)
PackageVulnerable rangeFixed inDependents
linux6.1.106-1 ... 6.1.99-1 (55 versions)6.1.180-1—
linux-6.12—6.12.100-1~deb12u1—
Debian:11(1)
PackageVulnerable rangeFixed inDependents
linux5.10.103-1 ... 5.10.92-2 (55 versions)5.10.262-1—
Debian:13(1)
PackageVulnerable rangeFixed inDependents
linux6.12.38-1 ... 6.12.95-1~bpo12+1 (30 versions)6.12.96-1—
Debian:14(1)
PackageVulnerable rangeFixed inDependents
linux6.12.100-1 ... 7.1~rc7-1~exp1 (156 versions)7.1.4-1—

Data Freshness Timeline

(refreshed 30× in last 7d / 58× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-21 00:48 UTCEG score recompute
  2. 2026-08-21 00:48 UTCGHSA enrichment
  3. 2026-08-20 22:55 UTCEPSS rescore
  4. 2026-08-20 12:06 UTCGHSA enrichment
  5. 2026-08-19 23:07 UTCEG score recompute
  6. 2026-08-19 23:07 UTCGHSA enrichment
  7. 2026-08-19 17:04 UTCEPSS rescore
  8. 2026-08-19 10:25 UTCGHSA enrichment
  9. 2026-08-18 21:41 UTCEG score recompute
  10. 2026-08-18 21:41 UTCGHSA enrichment
  11. 2026-08-18 13:48 UTCEPSS rescore
  12. 2026-08-18 08:38 UTCGHSA enrichment
  13. 2026-08-17 19:26 UTCEG score recompute
  14. 2026-08-17 19:26 UTCGHSA enrichment
  15. 2026-08-17 13:47 UTCEPSS rescore
  16. 2026-08-17 05:41 UTCEG score recompute
  17. 2026-08-17 05:41 UTCGHSA enrichment
  18. 2026-08-17 05:13 UTCEG score recompute
  19. 2026-08-17 05:13 UTCGHSA enrichment
  20. 2026-08-17 02:21 UTCEG score recompute
  21. 2026-08-17 02:21 UTCGHSA enrichment
  22. 2026-08-16 14:56 UTCEPSS rescore
  23. 2026-08-16 13:39 UTCEG score recompute
  24. 2026-08-16 13:39 UTCGHSA enrichment
  25. 2026-08-16 00:58 UTCGHSA enrichment
Show 33 more
  1. 2026-08-15 12:16 UTCEG score recompute
  2. 2026-08-15 12:16 UTCGHSA enrichment
  3. 2026-08-15 01:30 UTCEPSS rescore
  4. 2026-08-14 23:34 UTCGHSA enrichment
  5. 2026-08-14 10:53 UTCGHSA enrichment
  6. 2026-08-13 22:11 UTCEG score recompute
  7. 2026-08-13 22:11 UTCGHSA enrichment
  8. 2026-08-13 22:00 UTCEPSS rescore
  9. 2026-08-13 09:29 UTCGHSA enrichment
  10. 2026-08-12 20:48 UTCEG score recompute
  11. 2026-08-12 20:48 UTCGHSA enrichment
  12. 2026-08-12 13:51 UTCEPSS rescore
  13. 2026-08-12 08:07 UTCGHSA enrichment
  14. 2026-08-11 19:25 UTCEG score recompute
  15. 2026-08-11 19:25 UTCGHSA enrichment
  16. 2026-08-11 06:43 UTCEG score recompute
  17. 2026-08-11 06:43 UTCGHSA enrichment
  18. 2026-08-11 00:00 UTCEPSS rescore
  19. 2026-08-10 18:02 UTCGHSA enrichment
  20. 2026-08-10 05:21 UTCGHSA enrichment
  21. 2026-08-09 16:39 UTCEG score recompute
  22. 2026-08-09 16:39 UTCGHSA enrichment
  23. 2026-08-09 13:47 UTCEPSS rescore
  24. 2026-08-09 03:58 UTCEG score recompute
  25. 2026-08-09 03:58 UTCGHSA enrichment
  26. 2026-08-08 16:37 UTCEPSS rescore
  27. 2026-08-08 15:17 UTCEG score recompute▲ 7.80
  28. 2026-08-08 15:17 UTCGHSA enrichment
  29. 2026-08-08 15:16 UTCMITRE cvelistV5CVSS v3 → 7.8 · severity → HIGH
  30. 2026-08-06 13:47 UTCEPSS rescore
  31. 2026-08-06 08:21 UTCNVD update
  32. 2026-08-06 07:25 UTCEG score recompute
  33. 2026-08-06 07:25 UTCMITRE cvelistV5first tracked

Frequently asked(5)

What is CVE-2026-64599?
CVE-2026-64599 is a high vulnerability published on August 6, 2026. In the Linux kernel, the following vulnerability has been resolved: crypto: amlogic - avoid double cleanup in mesoncryptoprobe() When mesonallocatechanlist() fails after a partial allocation, it already unwinds the allocated chanlist state through its local error path. mesoncryptoprobe() then jump…
When was CVE-2026-64599 disclosed?
CVE-2026-64599 was first published in the National Vulnerability Database on August 6, 2026, with the most recent update on August 17, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-64599 actively exploited?
CVE-2026-64599 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 98.1% of all scored CVEs.
What is the CVSS score of CVE-2026-64599?
CVE-2026-64599 has a CVSS v3 base score of 7.8 (NVD).
How do I remediate CVE-2026-64599?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-64599, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-64599

Explore →

Is Your Infrastructure Affected by CVE-2026-64599?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs