Riskcovery

CVE-2026-63805

crypto: nx - fix nx_crypto_ctx_exit argument

State
Published
Severity
7.8 High
Published
Jul 19, 2026
Updated
Aug 17, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: nx - fix nx_crypto_ctx_exit argument

nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...) but crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *.

Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx call.

This fixes the following oops:

BUG: Unable to handle kernel data access at 0xc0403effffffffc8 Faulting instruction address: 0xc000000000396cb4 Oops: Kernel access of bad area, sig: 11 [#15] Call Trace: nx_crypto_ctx_shash_exit+0x24/0x60 crypto_shash_exit_tfm+0x28/0x40 crypto_destroy_tfm+0x98/0x140 crypto_exit_ahash_using_shash+0x20/0x40 crypto_destroy_tfm+0x98/0x140 hash_release+0x1c/0x30 alg_sock_destruct+0x38/0x60 __sk_destruct+0x48/0x2b0 af_alg_release+0x58/0xb0 __sock_release+0x68/0x150 sock_close+0x20/0x40 __fput+0x110/0x3a0 sys_close+0x48/0xa0 system_call_exception+0x140/0x2d0 system_call_common+0xf4/0x258

.. which came from hardlink(1) opportunistically using AF_ALG.

The same problem exists with nx_crypto_ctx_skcipher_exit getting a context it wasn't expecting, but apparently nobody hit that for years.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • bfd9efddf990d152dc9912fdca520c5e1e19e1e2 to before 8d8507a457667f23477a15496b91908a5b5b7cf3Affected
  • bfd9efddf990d152dc9912fdca520c5e1e19e1e2 to before 833033e6e55acf11304ff7bbbdf18351d139c281Affected
  • bfd9efddf990d152dc9912fdca520c5e1e19e1e2 to before 4e67f504ee9ded15e256b64f4fde150e917381d7Affected
LinuxLinux
  • 5.5Affected
  • before 5.5Not affected
  • 6.18.38 through 6.18.*Not affected
  • 7.1.3 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.