CVE-2026-46068: Linux Kernel Information Disclosure Issue

CVE-2026-46068 Overview

CVE-2026-46068 is a memory leak vulnerability in the Linux kernel's nx (Nest Accelerator) compression crypto driver. The flaw resides in the nx842_crypto_alloc_ctx() and nx842_crypto_free_ctx() functions, which manage bounce buffers used by the 842 compression algorithm hardware accelerator on POWER systems. The bounce buffers are allocated using __get_free_pages() with BOUNCE_BUFFER_ORDER (order 2, equating to 4 pages), but both the allocation error path and the free routine release these buffers using free_page() instead of free_pages() with the matching order. This mismatch causes three out of four pages to leak on every release.

Critical Impact
Repeated allocation and release of crypto contexts gradually exhausts kernel memory, leading to resource depletion and potential denial of service on affected systems.

Affected Products

Linux kernel — crypto/nx driver (842 compression module)
Multiple stable kernel branches prior to the referenced upstream fix commits
Systems using NX-842 hardware acceleration, primarily IBM POWER platforms

Discovery Timeline

2026-05-27 - CVE-2026-46068 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46068

Vulnerability Analysis

The Linux kernel crypto/nx driver provides a software interface to the NX-842 hardware compression accelerator. During context initialization, nx842_crypto_alloc_ctx() allocates two bounce buffers used to stage input and output data for the hardware engine. The allocation is performed via __get_free_pages(GFP_KERNEL, BOUNCE_BUFFER_ORDER), where BOUNCE_BUFFER_ORDER is defined as 2. This requests a contiguous physical allocation of four pages (2^2) per buffer.

The defect lies in the deallocation path. Both the error-recovery branch in nx842_crypto_alloc_ctx() and the teardown function nx842_crypto_free_ctx() release the memory by calling free_page(). The free_page() macro frees only a single page. As a result, three of the four allocated pages remain reserved on every release, producing a persistent kernel memory leak.

Root Cause

The root cause is an order mismatch between allocation and deallocation primitives [CWE-401]. Kernel page allocators require symmetric ordering: memory obtained with __get_free_pages(order) must be released with free_pages(addr, order). The fix substitutes free_pages() with the matching BOUNCE_BUFFER_ORDER value to restore symmetry.

Attack Vector

A local user with the ability to repeatedly invoke the 842 crypto transform — for example, through compression syscalls or AF_ALG socket interfaces — can trigger sustained allocation and release of nx842 contexts. Each cycle leaks three pages of kernel memory. Over time, this exhausts the page pool and degrades system stability. Network-based exploitation is not described in the upstream commit.

No public exploitation code is available. Refer to the upstream fix in Kernel Git Commit adb3faf2 for the patched implementation.

Detection Methods for CVE-2026-46068

Indicators of Compromise

Steady, unexplained growth in kernel memory usage reported by /proc/meminfo under MemFree and Slab counters on POWER systems using NX-842.
Repeated allocations attributed to the nx842_crypto module visible via /proc/vmallocinfo or tracefs page allocation events.
Kernel log entries indicating memory pressure or OOM kills on hosts running 842 compression workloads.

Detection Strategies

Audit installed kernel package versions against the fixed builds referenced in the upstream stable commits.
Monitor /proc/buddyinfo for declining availability of order-2 pages on systems performing frequent crypto operations.
Enable kernel memory leak detection (kmemleak) on test systems to confirm the leak signature within the nx-compress module.

Monitoring Recommendations

Track long-term kernel memory baselines and alert on monotonic growth not correlated with workload changes.
Inventory hosts loading the nx_compress and nx842 modules using lsmod collection across the fleet.
Correlate OOM and slab fragmentation events with cryptographic workload patterns on POWER hardware.

How to Mitigate CVE-2026-46068

Immediate Actions Required

Identify systems running the nx-compress or nx842 kernel modules, particularly IBM POWER hosts.
Schedule deployment of distribution kernel updates that incorporate the upstream fix commits.
Where patching is delayed, restrict local access and limit user invocation of 842 compression interfaces.

Patch Information

The fix replaces free_page() with free_pages(addr, BOUNCE_BUFFER_ORDER) in both the allocation error path and nx842_crypto_free_ctx(). The change has been merged across multiple stable trees. Apply the vendor kernel build that includes one of the following upstream commits: Kernel Git Commit 5c07962f, Kernel Git Commit 80fd99d7, Kernel Git Commit 910bb34b, Kernel Git Commit adb3faf2, or Kernel Git Commit f17a4850.

Workarounds

Unload the nx_compress and nx842 modules on hosts that do not require hardware-accelerated 842 compression.
Blacklist the nx-compress module via /etc/modprobe.d/ to prevent automatic loading at boot.
Restrict access to AF_ALG sockets and compression syscalls through seccomp profiles or container policies on multi-tenant systems.

bash

# Prevent automatic loading of the affected module
echo 'blacklist nx_compress' | sudo tee /etc/modprobe.d/disable-nx842.conf
echo 'blacklist nx-compress-powernv' | sudo tee -a /etc/modprobe.d/disable-nx842.conf
echo 'blacklist nx-compress-pseries' | sudo tee -a /etc/modprobe.d/disable-nx842.conf
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep -E 'nx_compress|nx842'