Linux Kernel up to 6.18.13/6.19.3 crypto stack-based overflow

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.13/6.19.3. It has been rated as critical. This affects an unknown function of the component crypto. The manipulation leads to stack-based overflow. This vulnerability is referenced as CVE-2026-45959. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.13/6.19.3. This issue affects an unknown function of the component crypto. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the kmalloc-family functions, with the `__cleanup(kfree)` attribute will make the address of the local variable, rather than the address returned by kmalloc, passed to kfree directly and lead to a crash due to invalid deallocation of stack address. According to other places in the repo, the correct usage should be `__free(kfree)`. The code coincidentally compiled because the parameter type `void *` of kfree is compatible with the desired type `struct { ... } **`.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-45959 since 05/13/2026. The exploitation is known to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/16/2026).

Upgrading to version 6.18.14 or 6.19.4 eliminates this vulnerability. Applying the patch 9a3ace9b010ffd8c422c97844ae152f7c53d6b18/90f9090e3e744a8fe3bb6fa0e61f577347728b0b/d5abcc33ee76bc26d58b39dc1a097e43a99dd438 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion