Executive brief
A vulnerability in the Linux kernel's crypto component could cause a system crash (kernel oops) when certain cryptographic operations are closed. This issue affects systems using the NX crypto driver, potentially leading to a denial-of-service. The problem occurs during the cleanup process of cryptographic contexts, which can be triggered by standard system utilities.
Technical details
A type mismatch exists in the nx_crypto_ctx_exit function within the Linux kernel's crypto/nx driver. The function nx_crypto_ctx_shash_exit incorrectly passes a pointer of type nx_crypto_ctx* to nx_crypto_ctx_exit, which was expecting a crypto_tfm* and subsequently performed an invalid crypto_tfm_ctx call. This results in a kernel 'oops' (invalid data access) during the destruction of transformation objects, particularly when triggered via AF_ALG. The vulnerability also affects nx_crypto_ctx_skcipher_exit. Patches have been released to correct the function signature and remove the erroneous context retrieval call.
Affected products
- Linux Linux Kernel 5.5 to 7.1.3
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory