High 7.8Published May 27, 2026

CVE-2026-46068crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx

Updated under an hour ago (Oct 27, 2026, 3:20 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx The bounce buffers are allocated with __get_free_pages() using BOUNCE_BUFFER_ORDER (order 2 = 4 pages), but both the allocation error path and nx842_crypto_free_ctx() release the buffers with free_page(). Use free_pages() with the matching order instead.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ed70b479c2c0b6e1319f0cb2de19f1051be219a4 before f17a4850d1ce7c11cba8b1830b9bfedfede878bb; from ed70b479c2c0b6e1319f0cb2de19f1051be219a4 before 910bb34b801d39794e656f7d48414844b2bd354e; from ed70b479c2c0b6e1319f0cb2de19f1051be219a4 before 5c07962fed66e1238fad7635fa150570bd38b4c5; from ed70b479c2c0b6e1319f0cb2de19f1051be219a4 before 80fd99d7c30ea889662d21f1b44d8fea4c83138d; from ed70b479c2c0b6e1319f0cb2de19f1051be219a4 before adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c	CNA record
linux linux_kernel linux:linux_kernel	from 4.2 before 6.6.141; from 6.7 before 6.12.88; from 6.13 before 6.18.27; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/f17a4850d1ce7c11cba8b1830b9bfedfede878bb	patch
https://git.kernel.org/stable/c/910bb34b801d39794e656f7d48414844b2bd354e	patch
https://git.kernel.org/stable/c/5c07962fed66e1238fad7635fa150570bd38b4c5	patch
https://git.kernel.org/stable/c/80fd99d7c30ea889662d21f1b44d8fea4c83138d	patch
https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.