---
id: CVE-2026-63805
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: nx - fix nx_crypto_ctx_exit argument

  nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...)
  but crypto_shash_ctx gives a nx_crypto_ctx *,…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: nx - fix nx_crypto_ctx_exit argument

  nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...)
  but crypto_shash_ctx gives a nx_crypto_ctx *,…
severity: none
published: '2026-07-19'
updated: '2026-07-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63805'
references:
  - url: 'https://git.kernel.org/stable/c/4e67f504ee9ded15e256b64f4fde150e917381d7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/833033e6e55acf11304ff7bbbdf18351d139c281'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8d8507a457667f23477a15496b91908a5b5b7cf3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
ingestedAt: '2026-07-20T09:37:17.736Z'
epss: 0.00134
epssPercentile: 0.02389
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: nx - fix nx_crypto_ctx_exit argument

nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...)
but crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *.

Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx
call.

This fixes the following oops:

  BUG: Unable to handle kernel data access at 0xc0403effffffffc8
  Faulting instruction address: 0xc000000000396cb4
  Oops: Kernel access of bad area, sig: 11 [#15]
  Call Trace:
   nx_crypto_ctx_shash_exit+0x24/0x60
   crypto_shash_exit_tfm+0x28/0x40
   crypto_destroy_tfm+0x98/0x140
   crypto_exit_ahash_using_shash+0x20/0x40
   crypto_destroy_tfm+0x98/0x140
   hash_release+0x1c/0x30
   alg_sock_destruct+0x38/0x60
   __sk_destruct+0x48/0x2b0
   af_alg_release+0x58/0xb0
   __sock_release+0x68/0x150
   sock_close+0x20/0x40
   __fput+0x110/0x3a0
   sys_close+0x48/0xa0
   system_call_exception+0x140/0x2d0
   system_call_common+0xf4/0x258

.. which came from hardlink(1) opportunistically using AF_ALG.

The same problem exists with nx_crypto_ctx_skcipher_exit getting a context
it wasn't expecting, but apparently nobody hit that for years.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.