CVE-2026-63805 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
crypto: nx - fix nx_crypto_ctx_exit argument
nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...) but crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *.
Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx call.
This fixes the following oops:
BUG: Unable to handle kernel data access at 0xc0403effffffffc8 Faulting instruction address: 0xc000000000396cb4 Oops: Kernel access of bad area, sig: 11 [#15]
Call Trace: nx_crypto_ctx_shash_exit+0x24/0x60 crypto_shash_exit_tfm+0x28/0x40 crypto_destroy_tfm+0x98/0x140 crypto_exit_ahash_using_shash+0x20/0x40 crypto_destroy_tfm+0x98/0x140 hash_release+0x1c/0x30 alg_sock_destruct+0x38/0x60 __sk_destruct+0x48/0x2b0 af_alg_release+0x58/0xb0 __sock_release+0x68/0x150 sock_close+0x20/0x40 __fput+0x110/0x3a0 sys_close+0x48/0xa0 system_call_exception+0x140/0x2d0 system_call_common+0xf4/0x258
.. which came from hardlink(1) opportunistically using AF_ALG.
The same problem exists with nx_crypto_ctx_skcipher_exit getting a context it wasn't expecting, but apparently nobody hit that for years.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the Linux kernel's cryptographic subsystem, specifically in the nx_crypto driver implementation that handles hardware-accelerated cryptography operations. The issue manifests as a type mismatch error during the cleanup phase of cryptographic operations, where function parameters are passed with incorrect data types. The root cause occurs when nx_crypto_ctx_shash_exit invokes nx_crypto_ctx_exit with an argument that expects a crypto_tfm pointer but receives a nx_crypto_ctx pointer instead. This fundamental type confusion leads to kernel memory access violations and system crashes.
The technical flaw stems from improper parameter handling in the cryptographic context management code, specifically violating the expected interface contracts between kernel subsystems. When the kernel attempts to process cryptographic operations through AF_ALG (Algorithmic Framework for Cryptographic Operations), the incorrect pointer casting causes memory dereferencing at an invalid address location. The kernel oops trace reveals a data access violation at address 0xc0403effffffffc8 with faulting instruction at 0xc000000000396cb4, demonstrating how the mismatched types lead to unauthorized memory access patterns.
The operational impact of this vulnerability extends beyond simple kernel crashes, as it affects the stability and reliability of cryptographic operations within the Linux system. The error cascade begins with hardlink(1) utilizing AF_ALG functionality, which triggers the problematic code path through multiple kernel functions including crypto_shash_exit_tfm, crypto_destroy_tfm, and various socket destruction handlers. This vulnerability essentially creates a denial-of-service condition that can crash the entire kernel when cryptographic operations are performed, potentially affecting system availability for critical security functions.
The fix implemented addresses the core type mismatch by correcting the argument passed to nx_crypto_ctx_exit from crypto_shash_ctx(...) which returns a nx_crypto_ctx to the proper crypto_tfm pointer type. This correction aligns with established kernel coding practices and standards such as those defined in the Common Weakness Enumeration (CWE-688) for incorrect type assignment and CWE-121 for buffer overflow conditions. The solution follows the ATT&CK framework's mitigation principles by addressing a kernel-level vulnerability that could be exploited to cause system instability, with the fix focusing on preventing improper memory access patterns during cryptographic context cleanup operations.
Additional analysis reveals that while the primary issue was identified and fixed in nx_crypto_ctx_shash_exit, a similar type mismatch exists in nx_crypto_ctx_skcipher_exit but has remained dormant due to lack of triggering conditions over years of operation. This secondary vulnerability demonstrates how kernel subsystems can harbor multiple related issues that may not manifest under normal operating conditions, emphasizing the importance of thorough code review and static analysis for cryptographic implementations. The fix ensures proper type handling throughout the nx_crypto driver context management, preventing unauthorized memory access that could be leveraged to escalate privileges or cause system instability in certain exploitation scenarios.