CVE-2026-41564: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-41564 is a PRNG fork-safety vulnerability in the CryptX Perl library (versions before 0.088) where Crypt::PK::* modules fail to reseed their per-object pseudo-random number generator state after a fork() call. Affected modules include Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC, Crypt::PK::Ed25519, and Crypt::PK::X25519. The vulnerability was discovered on 2026-04-18, reported to the upstream maintainer on 2026-04-21, and publicly disclosed alongside the release of CryptX 0.088 on 2026-04-23. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-335 (Incorrect Usage of Seeds in Pseudo-Random Number Generator) and CWE-338 (Use of Cryptographically Weak PRNG). Each Crypt::PK::* object seeds a ChaCha20-based PRNG state in its constructor and stores the current PID; however, prior to version 0.088, there was no mechanism to detect a fork() and reseed the PRNG in child processes. As a result, a Crypt::PK::* object instantiated before fork() shares byte-identical PRNG state with all child processes, causing them to produce identical cryptographic outputs. The fix (commit 9a1dd3e) adds a last_pid field to each PK struct and a cryptx_internal_pk_prng_reseed() function that checks the current PID against the stored PID before any randomized operation, reseeding with fresh entropy if a fork is detected. In preforking servers like Starman, where a single object is created at startup and inherited by all workers, two ECDSA or DSA signatures from different worker processes sharing the same nonce are sufficient to recover the private signing key via standard nonce-reuse key recovery math (GitHub Advisory, oss-security, Patch).

The primary impact is a high-severity confidentiality breach: an attacker who can observe two ECDSA or DSA signatures produced by different worker processes of a preforking service can mathematically recover the private signing key, completely compromising the cryptographic identity of the service. Key generation operations are equally affected — all worker processes may generate byte-identical RSA, ECC, DH, Ed25519, and X25519 keys, rendering them cryptographically worthless. There is no integrity or availability impact, but the exposure of private keys could enable impersonation, decryption of past or future communications, and session hijacking depending on how the keys are used (oss-security, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.000180 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation is theoretically straightforward for an attacker who can trigger and observe multiple signatures from a vulnerable preforking service — the nonce-reuse private key recovery technique for ECDSA/DSA is well-documented in cryptographic literature and requires only two signatures with the same nonce (GitHub Advisory, oss-security).

1. Identify a vulnerable target: Locate a preforking Perl web service (e.g., running Starman) that uses CryptX < 0.088 and performs ECDSA or DSA signing operations (e.g., JWT signing, TLS client auth, API request signing) using a Crypt::PK::* object initialized before workers are forked.
2. Trigger signature generation: Send two or more requests to the service that cause different worker processes to produce ECDSA or DSA signatures over attacker-controlled or observable data. Because all workers share the same PRNG state, the per-signature nonce (k) will be identical across workers.
3. Collect signatures: Capture the two signatures (r, s1) and (r, s2) — the identical r value confirms nonce reuse.
4. Recover the private key: Apply the standard ECDSA/DSA nonce-reuse key recovery formula: given two signatures (r, s1, h1) and (r, s2, h2) with the same nonce k, compute k = (h1 - h2) / (s1 - s2) mod q, then recover the private key d = (s1*k - h1) / r mod q.
5. Exploit recovered key: Use the recovered private key to forge signatures, impersonate the service, decrypt communications, or escalate access depending on the key's role (oss-security, GitHub Advisory).

• Application Behavior: Multiple ECDSA or DSA signatures from the same service returning identical r values — this is a direct indicator of nonce reuse and shared PRNG state.
• Key Material: Cryptographic keys generated by different worker processes that are byte-identical (detectable by comparing JWK thumbprints or public key exports across workers).
• Logs: Application logs showing a Crypt::PK::* object instantiated at startup (before worker fork) in a preforking server such as Starman; absence of per-worker PRNG reseeding log entries in CryptX versions prior to 0.088.
• Process: Preforking server processes (e.g., starman, plackup) running with CryptX < 0.088 where the parent process initializes cryptographic objects before spawning workers.

Upgrade CryptX to version 0.088 or later, which introduces automatic PID-based fork detection and PRNG reseeding before any randomized cryptographic operation (GitHub Advisory, Patch). As a workaround if immediate patching is not possible, restructure application code to create Crypt::PK::* objects after fork() rather than before, ensuring each worker process has its own independently seeded PRNG state. Critically, the oss-security advisory notes that the fix does not retroactively protect already-exposed keys — any private key used with or generated by a Crypt::PK::* object created before fork() on an affected version should be assessed for rotation (oss-security). Distribution-level patches are available for Fedora, Amazon Linux 2023, and openSUSE.

The vulnerability was discovered and responsibly disclosed by Stig Palmquist (stigtsp) of CPANSec, who reported it to the upstream maintainer on 2026-04-21 and coordinated a same-day public disclosure with the release of the fix on 2026-04-23 (oss-security). The issue was noted on Bluesky and Mastodon by infosec community accounts shortly after disclosure. Red Hat, Fedora, Amazon Linux, and openSUSE all tracked and issued distribution-level advisories. The vulnerability received moderate community attention given its practical impact on preforking Perl web services.