CVE-2026-63805 crypto: nx - fix nx_crypto_ctx_exit argument
A type confusion error in the Linux kernel's NX crypto driver causes a kernel oops and denial of service when closing AF_ALG sockets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63805?
CVE-2026-63805 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: nx - fix nx_crypto_ctx_exit argument
nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...) but crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *.
Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx call.
This fixes the following oops:
BUG: Unable to handle kernel data access at 0xc0403effffffffc8 Faulting instruction address: 0xc000000000396cb4 Oops: Kernel access of bad area, sig: 11 [#15] Call Trace: nx_crypto_ctx_shash_exit+0x24/0x60 crypto_shash_exit_tfm+0x28/0x40 crypto_destroy_tfm+0x98/0x140 crypto_exit_ahash_using_shash+0x20/0x40 crypto_destroy_tfm+0x98/0x140 hash_release+0x1c/0x30 alg_sock_destruct+0x38/0x60 __sk_destruct+0x48/0x2b0 af_alg_release+0x58/0xb0 __sock_release+0x68/0x150 sock_close+0x20/0x40 __fput+0x110/0x3a0 sys_close+0x48/0xa0 system_call_exception+0x140/0x2d0 system_call_common+0xf4/0x258
.. which came from hardlink(1) opportunistically using AF_ALG.
The same problem exists with nx_crypto_ctx_skcipher_exit getting a context it wasn't expecting, but apparently nobody hit that for years.
Which versions are affected by CVE-2026-63805?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-63805?
Apply the vendor's patch.
Is CVE-2026-63805 being exploited?
There is no known exploitation of CVE-2026-63805 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-63805, DEBIAN-CVE-2026-63805, GHSA-3m8h-qjhw-m7c5, ROOT-OS-DEBIAN-11-CVE-2026-63805, ROOT-OS-DEBIAN-12-CVE-2026-63805, ROOT-OS-DEBIAN-13-CVE-2026-63805 and 2 more.