CVE-2026-64313 addresses a vulnerability in the Linux kernel's elliptic curve cryptography (ECC) code, specifically in the vli multiplication implementation. The carry flag calculation failed when the high part of an intermediate multiplication result (r01.m_high) was saturated at 0xFFFFFFFFFFFFFFFF and an overflow occurred in the addition of lower bits. The original condition did not handle cases where r01.m_high equaled the product's high part but an additional carry existed from the lower bits. This flaw was introduced during a refactor that split the muladd() function into separate multiplication and addition helpers, losing a critical check. The patch adds proper handling for this boundary condition by accounting for the carry from the lower addition, ensuring correct cryptographic computations.

The vulnerability could cause incorrect calculations in the ECC cryptographic operations within the Linux kernel. While no specific exploitation or impact scenarios are detailed, incorrect cryptographic computations could undermine the security guarantees of ECC-based operations relying on this code. There are no known exploits in the wild reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a kernel cryptographic code fix, users should monitor official Linux kernel releases and apply updates once the fix is included. No alternative mitigations are provided.