CVE-2026-64544

In the Linux kernel, the following vulnerability has been resolved:

crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents

pefiledigestpecontents() computes the trailing-data hash length as pelen - (hashedbytes + certssize). A crafted PE can make the addition exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB. This is passed to cryptoshash_update() which reads out of bounds and panics on unmapped vmalloc guard pages.

BUG: unable to handle page fault for address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256blocksgeneric (lib/crypto/sha256.c:152) Call Trace: <TASK> __sha256update (lib/crypto/sha256.c:208) cryptosha256update (crypto/sha256.c:142) verifypefilesignature (crypto/asymmetrickeys/verifypefile.c:436) kexeckernelverifypesig (kernel/kexecfile.c:151) _dosyskexecfileload (kernel/kexecfile.c:406) dosyscall64 (arch/x86/entry/syscall64.c:94) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) </TASK> Kernel panic - not syncing: Fatal exception

Validate that the addition does not overflow and the result does not exceed pelen before the subtraction. Return -ELIBBAD on failure.