What is CVE-2026-63805?

CVE-2026-63805 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 5.5 onward and patched in 6.18.38, 7.1.3 and 7.2. CVE-2026-63805 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-63805?

CVE-2026-63805 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-63805?

Yes, CVE-2026-63805 has been patched. Fixed versions include 6.18.38, 7.1.3 and 7.2. If you are running Linux kernel 5.5 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-63805 actively exploited?

CVE-2026-63805 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-63805

High

In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix nx_crypto_ctx_exit argument nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...) but crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *. Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx call. This fixes the following oops: BUG: Unable to handle kernel data access at 0xc0403effffffffc8 Faulting instruction address: 0xc000000000396cb4 Oops: Kernel access of bad area, sig: 11 [#15] Call Trace: nx_crypto_ctx_shash_exit+0x24/0x60 crypto_shash_exit_tfm+0x28/0x40 crypto_destroy_tfm+0x98/0x140 crypto_exit_ahash_using_shash+0x20/0x40 crypto_destroy_tfm+0x98/0x140 hash_release+0x1c/0x30 alg_sock_destruct+0x38/0x60 __sk_destruct+0x48/0x2b0 af_alg_release+0x58/0xb0 __sock_release+0x68/0x150 sock_close+0x20/0x40 __fput+0x110/0x3a0 sys_close+0x48/0xa0 system_call_exception+0x140/0x2d0 system_call_common+0xf4/0x258 .. which came from hardlink(1) opportunistically using AF_ALG. The same problem exists with nx_crypto_ctx_skcipher_exit getting a context it wasn't expecting, but apparently nobody hit that for years.

Package Linux Kernel

Published 2026-07-19

Last modified 2026-08-17

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 5.5 and later are affected. Fixed in 6.18.38, 7.1.3, 7.2 and their respective stable series.

Affected from

≥ 5.5

Fixed in

✓ 6.18.38 6.18.x ✓ 7.1.3 7.1.x ✓ 7.2

References

3 total

Kernel Git
https://git.kernel.org/stable/c/4e67f504ee9ded15e256b64f4fde150e917381d7

Patch
Kernel Git
https://git.kernel.org/stable/c/833033e6e55acf11304ff7bbbdf18351d139c281

Patch
Kernel Git
https://git.kernel.org/stable/c/8d8507a457667f23477a15496b91908a5b5b7cf3

Patch

Details

CVE ID CVE-2026-63805

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-07-19

Modified 2026-08-17

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-63805?

CVE-2026-63805 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 5.5 onward and has been patched in 6.18.38, 7.1.3 and 7.2. CVE-2026-63805 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-63805?

CVE-2026-63805 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-63805?

Yes. CVE-2026-63805 has been patched. Fixed versions include 6.18.38, 7.1.3 and 7.2. If you are running Linux kernel 5.5 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-63805 actively exploited?

No. CVE-2026-63805 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.