In the Linux kernel, the following vulnerability has been resolved:
crypto: nx - fix nx_crypto_ctx_exit argument
nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...) but crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *.
Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx call.
This fixes the following oops:
BUG: Unable to handle kernel data access at 0xc0403effffffffc8 Faulting instruction address: 0xc000000000396cb4 Oops: Kernel access of bad area, sig: 11 [#15] Call Trace: nx_crypto_ctx_shash_exit+0x24/0x60 crypto_shash_exit_tfm+0x28/0x40 crypto_destroy_tfm+0x98/0x140 crypto_exit_ahash_using_shash+0x20/0x40 crypto_destroy_tfm+0x98/0x140 hash_release+0x1c/0x30 alg_sock_destruct+0x38/0x60 __sk_destruct+0x48/0x2b0 af_alg_release+0x58/0xb0 __sock_release+0x68/0x150 sock_close+0x20/0x40 __fput+0x110/0x3a0 sys_close+0x48/0xa0 system_call_exception+0x140/0x2d0 system_call_common+0xf4/0x258
.. which came from hardlink(1) opportunistically using AF_ALG.
The same problem exists with nx_crypto_ctx_skcipher_exit getting a context it wasn't expecting, but apparently nobody hit that for years.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-7.0.0-1006-gke-64kUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-raspiUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-gke-64kUpgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-azure-7.0Upgrade linux-image-7.0.0-2018-nvidia-bosUpgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-7.0.0-1018-nvidiaUpgrade linux-image-oem-7.0Upgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-7.0.0-1019-raspi-realtimeUpgrade linux-image-7.0.0-1018-nvidia-64kUpgrade linux-image-oracle-7.0Upgrade linux-image-nvidia-bosUpgrade linux-image-gke-7.0Upgrade linux-image-gcp-64kUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-nvidia-64kUpgrade linux-image-7.0.0-31-genericUpgrade linux-image-ibm-7.0Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-7.0.0-1019-raspiUpgrade linux-image-7.0.0-1011-oracleUpgrade linux-image-gcp-7.0Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-raspi-7.0Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-awsUpgrade linux-image-realtimeUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-oracle-64k-7.0Upgrade linux-image-generic-7.0Upgrade linux-image-oem-26.04bUpgrade linux-image-realtime-7.0Upgrade linux-image-7.0.0-1013-ibmUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-aws-64k-7.0Upgrade linux-image-7.0.0-1014-azureUpgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-gkeUpgrade linux-image-azure-lts-26.04Upgrade linux-image-virtualUpgrade linux-image-gke-hwe-26.04Upgrade linux-image-oracleUpgrade linux-image-realtime-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-aws-64kUpgrade linux-image-7.0.0-1012-aws-64kUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-7.0.0-31-realtimeUpgrade linux-image-7.0.0-1011-oracle-64kUpgrade linux-image-7.0.0-1006-gkeUpgrade linux-image-virtual-7.0 | Sep 14, 2026 | Sep 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub