CVE-2026-63805: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63805 Overview

CVE-2026-63805 is a Linux kernel vulnerability in the nx crypto driver. The flaw resides in nx_crypto_ctx_shash_exit, which passes an incorrect context type to nx_crypto_ctx_exit. The function receives a nx_crypto_ctx * from crypto_shash_ctx() but treats it as a crypto_tfm *, causing a kernel oops when the context is dereferenced. Triggering the fault requires local access to the AF_ALG socket interface. The bug has been observed in production when tools like hardlink(1) opportunistically use AF_ALG for hashing.

Critical Impact
Local users can trigger a kernel oops through the AF_ALG interface, causing denial of service on Power architecture systems using the nx crypto accelerator.

Affected Products

Linux kernel with the drivers/crypto/nx (Nest Accelerator) driver enabled
IBM Power systems using the nx crypto accelerator for SHA hashing
Kernel builds exposing the AF_ALG userspace crypto API

Discovery Timeline

2026-07-19 - CVE-2026-63805 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63805

Vulnerability Analysis

The nx crypto driver provides hardware-accelerated cryptographic operations on IBM Power systems. When a shash transform is destroyed, nx_crypto_ctx_shash_exit is invoked to release the driver-specific context. This exit handler calls nx_crypto_ctx_exit with the return value of crypto_shash_ctx(tfm), which yields a pointer directly to the nx_crypto_ctx structure embedded in the transform.

However, nx_crypto_ctx_exit was declared to accept a crypto_tfm * and internally re-applied crypto_tfm_ctx() to the argument. The double indirection caused the driver to interpret arbitrary memory as an nx_crypto_ctx, resulting in the kernel oops Unable to handle kernel data access at 0xc0403effffffffc8 observed in the call trace originating from __fput and sys_close.

The same type mismatch exists in nx_crypto_ctx_skcipher_exit, though it had not been publicly reported before this patch series. The fix corrects the parameter type in nx_crypto_ctx_exit and removes the erroneous crypto_tfm_ctx call.

Root Cause

The root cause is a Type Confusion [CWE-843] between nx_crypto_ctx * and crypto_tfm *. Two different pointer types were treated interchangeably during transform teardown, and an extra crypto_tfm_ctx() translation was applied to an already-resolved context pointer.

Attack Vector

Exploitation requires local access with the ability to open an AF_ALG socket and request a hash algorithm handled by the nx driver. Closing the socket triggers the destructor chain (af_alg_release → __sk_destruct → alg_sock_destruct → hash_release → crypto_destroy_tfm) which reaches the faulty exit handler. Any unprivileged user with AF_ALG access on an affected Power system can crash the kernel.

The vulnerability manifests during transform teardown. See the referenced kernel commits for the corrected function signatures and the removal of the redundant context translation.

Detection Methods for CVE-2026-63805

Indicators of Compromise

Kernel oops entries in dmesg referencing nx_crypto_ctx_shash_exit+0x24/0x60 in the call trace
Faults with the signature BUG: Unable to handle kernel data access at 0xc040... on Power systems
Crashes originating from af_alg_release and sock_close in kernel backtraces
Repeated segmentation faults or system hangs when hardlink(1) or similar tools run on Power hardware

Detection Strategies

Monitor /var/log/kern.log and journalctl -k for oops messages containing nx_crypto_ctx symbols
Inventory running kernels on Power systems and compare against patched stable versions containing commits 4e67f50, 833033e, or 8d8507a
Audit userland processes invoking AF_ALG sockets on systems that load the nx-crypto module

Monitoring Recommendations

Enable kdump on Power hosts so oops crash dumps are captured for post-incident analysis
Alert on unexpected reboots or kernel panics on Power servers running crypto workloads
Track kernel module loads for nx_crypto, nx-compress, and related components across the fleet

How to Mitigate CVE-2026-63805

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commit hashes 4e67f504, 833033e6, and 8d8507a4
Restrict local shell access on Power systems until patched kernels are deployed
Identify workloads using AF_ALG and validate whether they can be routed to software crypto implementations temporarily

Patch Information

The fix corrects the argument type of nx_crypto_ctx_exit and removes the extraneous crypto_tfm_ctx() call. Patches are available at Kernel Patch 4e67f50, Kernel Patch 833033e, and Kernel Patch 8d8507a. Distributions maintaining Power kernels should backport these commits to their supported branches.

Workarounds

Blacklist the nx_crypto kernel module on affected Power systems where hardware acceleration is not required
Disable the AF_ALG interface by unloading algif_hash and preventing its autoload via modprobe configuration
Limit local user access and remove SUID utilities that opportunistically use AF_ALG such as hardlink

bash

# Prevent the nx_crypto module from loading
echo 'blacklist nx_crypto' | sudo tee /etc/modprobe.d/blacklist-nx-crypto.conf

# Block the AF_ALG hash interface
echo 'install algif_hash /bin/true' | sudo tee /etc/modprobe.d/disable-algif_hash.conf

# Reload module configuration
sudo depmod -a
sudo update-initramfs -u