{"id":14882,"date":"2026-09-04T19:02:16","date_gmt":"2026-09-04T11:02:16","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63805"},"modified":"2026-09-04T19:02:16","modified_gmt":"2026-09-04T11:02:16","slug":"cve-2026-63805","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63805","title":{"rendered":"CVE-2026-63805 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: nx &#8211; fix nx_c"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>crypto: nx &#8211; fix nx_crypto_ctx_exit argument<\/p>\n<p>nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(&#8230;)<br \/>\nbut crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *.<\/p>\n<p>Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx<br \/>\ncall.<\/p>\n<p>This fixes the following oops:<\/p>\n<p>  BUG: Unable to handle kernel data access at 0xc0403effffffffc8<br \/>\n  Faulting instruction address: 0xc000000000396cb4<br \/>\n  Oops: Kernel access of bad area, sig: 11 [#15]<br \/>\n  Call Trace:<br \/>\n   nx_crypto_ctx_shash_exit+0x24\/0x60<br \/>\n   crypto_shash_exit_tfm+0x28\/0x40<br \/>\n   crypto_destroy_tfm+0x98\/0x140<br \/>\n   crypto_exit_ahash_using_shash+0x20\/0x40<br \/>\n   crypto_destroy_tfm+0x98\/0x140<br \/>\n   hash_release+0x1c\/0x30<br \/>\n   alg_sock_destruct+0x38\/0x60<br \/>\n   __sk_destruct+0x48\/0x2b0<br \/>\n   af_alg_release+0x58\/0xb0<br \/>\n   __sock_release+0x68\/0x150<br \/>\n   sock_close+0x20\/0x40<br \/>\n   __fput+0x110\/0x3a0<br \/>\n   sys_close+0x48\/0xa0<br \/>\n   system_call_exception+0x140\/0x2d0<br \/>\n   system_call_common+0xf4\/0x258<\/p>\n<p>.. which came from hardlink(1) opportunistically using AF_ALG.<\/p>\n<p>The same problem exists with nx_crypto_ctx_skcipher_exit getting a context<br \/>\nit wasn&#8217;t expecting, but apparently nobody hit that for years.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>crypto: nx &#8211; fix nx_crypto_ctx_exit argument<\/p>\n<p>nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(&#8230;)<br \/>\nbut cryp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14882","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14882","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14882"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14882"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14882"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}