---
id: CVE-2026-45959
title: 'crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

  Annotating a local pointer variable, which will be assigned with the
  kmalloc-family functions, with t…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a71475582ada92ba021852bf3c2b40ab3718549b <
    9a3ace9b010ffd8c422c97844ae152f7c53d6b18
  - >-
    Linux >= a71475582ada92ba021852bf3c2b40ab3718549b <
    90f9090e3e744a8fe3bb6fa0e61f577347728b0b
  - >-
    Linux >= a71475582ada92ba021852bf3c2b40ab3718549b <
    d5abcc33ee76bc26d58b39dc1a097e43a99dd438
  - Linux 6.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:18:37.644714Z'
published: '2026-05-27'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:47.684Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45959'
references:
  - url: 'https://git.kernel.org/stable/c/9a3ace9b010ffd8c422c97844ae152f7c53d6b18'
  - url: 'https://git.kernel.org/stable/c/90f9090e3e744a8fe3bb6fa0e61f577347728b0b'
  - url: 'https://git.kernel.org/stable/c/d5abcc33ee76bc26d58b39dc1a097e43a99dd438'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02129
ingestedAt: '2026-10-16T17:24:46.701Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

Annotating a local pointer variable, which will be assigned with the
kmalloc-family functions, with the `__cleanup(kfree)` attribute will
make the address of the local variable, rather than the address returned
by kmalloc, passed to kfree directly and lead to a crash due to invalid
deallocation of stack address. According to other places in the repo,
the correct usage should be `__free(kfree)`. The code coincidentally
compiled because the parameter type `void *` of kfree is compatible with
the desired type `struct { ... } **`.

## Affected

- `Linux >= a71475582ada92ba021852bf3c2b40ab3718549b < 9a3ace9b010ffd8c422c97844ae152f7c53d6b18`
- `Linux >= a71475582ada92ba021852bf3c2b40ab3718549b < 90f9090e3e744a8fe3bb6fa0e61f577347728b0b`
- `Linux >= a71475582ada92ba021852bf3c2b40ab3718549b < d5abcc33ee76bc26d58b39dc1a097e43a99dd438`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.