# CVE-2026-63805: crypto: nx - fix nx_crypto_ctx_exit argument

CVE-2026-63805 is fixed in linux on 1 platform by DEBIAN-CVE-2026-63805 (version 7.1.3-1), released July 20, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-63805
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0013
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 19, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63805

## Description

In the Linux kernel, the following vulnerability has been resolved:  crypto: nx - fix nx_crypto_ctx_exit argument  nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...) but crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *.  Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx call.  This fixes the following oops:    BUG: Unable to handle kernel data access at 0xc0403effffffffc8   Faulting instruction address: 0xc000000000396cb4   Oops: Kernel access of bad area, sig: 11 [#15]   Call Trace:    nx_crypto_ctx_shash_exit+0x24/0x60    crypto_shash_exit_tfm+0x28/0x40    crypto_destroy_tfm+0x98/0x140    crypto_exit_ahash_using_shash+0x20/0x40    crypto_destroy_tfm+0x98/0x140    hash_release+0x1c/0x30    alg_sock_destruct+0x38/0x60    __sk_destruct+0x48/0x2b0    af_alg_release+0x58/0xb0    __sock_release+0x68/0x150    sock_close+0x20/0x40    __fput+0x110/0x3a0    sys_close+0x48/0xa0    system_call_exception+0x140/0x2d0    system_call_common+0xf4/0x258  .. which came from hardlink(1) opportunistically using AF_ALG.  The same problem exists with nx_crypto_ctx_skcipher_exit getting a context it wasn't expecting, but apparently nobody hit that for years.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.1.3-1 | [DEBIAN-CVE-2026-63805](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63805.md) | Jul 20, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.