Linux Kernel CVE-2026-80565

Exploitation requires: (1) the target system must contain Qualcomm QCE crypto hardware and have the kernel built with CONFIG_CRYPTO_DEV_QCE enabled - systems without this hardware or configuration are entirely unaffected; (2) the attacker must trigger a failure in ops->register_algs() during the algorithm registration loop, which is a non-default, transient condition typically associated with driver probe failure or resource exhaustion; (3) local access with at least low-privilege credentials is required per the CVSS PR:L metric. Exploitation is limited by the hardware-specificity of the QCE driver and the need to reproduce a driver initialization failure path, which is not trivially controllable from userspace under normal conditions.

The NVD-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects worst-case exploitation of a memory-corruption primitive on a local system. However, several factors constrain real-world risk substantially. First, the flaw is hardware-gated: only systems with Qualcomm QCE hardware (Snapdragon SoC devices, certain ARM-based embedded platforms, or mobile devices running mainline Linux) load this driver. Standard x86 servers and most cloud instances are entirely unaffected. Second, the triggering condition requires a failed algorithm registration - a non-default, typically transient hardware or driver initialization failure. Third, exploitability depends on whether the incorrect unregister call causes actionable memory corruption or merely a resource leak, which is not independently confirmed from the available description. EPSS data was not provided. No POC code is publicly known. No KEV listing exists. The assessed real-world priority is LOW for most environments and MEDIUM only for organizations managing fleets of Qualcomm-based embedded Linux devices (Android, industrial IoT, networking appliances). The provided AC:L metric may overstate exploitability - reliably triggering a registration failure in a controlled way likely requires AC:H conditions in practice.

An attacker with local low-privilege access on a Qualcomm SoC-based Linux system (such as an Android device running mainline Linux, an embedded networking appliance, or a Snapdragon-based development board) could attempt to trigger a QCE algorithm registration failure - for example, by inducing a resource exhaustion or hardware fault condition during driver initialization. If the incorrect unregister path causes a use-after-free or double-free in the crypto subsystem, the attacker could potentially leverage this memory corruption primitive to escalate to kernel execution privileges. No public proof-of-concept exploit exists, making this scenario theoretical at time of analysis.