The Linux kernel's crypto qat driver had a vulnerability (CVE-2026-64304) where the RSA CRT components (p, q, dp, dq, qinv) could be larger than the half-size DMA buffers allocated by qat_rsa_setkey_crt(). The existing generic RSA key parser bounds each CRT component by the modulus size, but the qat driver copies these components into half-size buffers without verifying if the component length exceeds half the key size. This leads to an underflow in the memcpy offset calculation and causes memory corruption by writing out of bounds. The patch adds explicit length checks for each CRT component to ensure they do not exceed half the key size, causing the driver to revert to a non-CRT code path instead of corrupting memory.

This vulnerability can cause memory corruption in the kernel crypto qat driver when processing RSA keys with CRT components larger than expected. Memory corruption in kernel space can lead to system instability, crashes, or potentially privilege escalation if exploited. However, no known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to add length checks for RSA CRT components in the crypto qat driver, preventing out-of-bounds writes. Users should update their Linux kernel to a version that includes this patch. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. Patch status is not explicitly stated here; check the Linux kernel vendor advisory or source repository for the exact fixed version.