PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45959 Linux CVE debrief

A memory management defect in the Linux kernel's AMD Cryptographic Coprocessor (CCP) driver could cause system crashes due to improper cleanup attribute usage. The vulnerability stems from incorrect application of the `__cleanup(kfree)` attribute on a local pointer variable, which causes the address of the stack variable itself—rather than the heap-allocated memory returned by kmalloc—to be passed to kfree. This results in invalid deallocation of a stack address. The fix replaces `__cleanup(kfree)` with `__free(kfree)`, which correctly dereferences the pointer to free the allocated memory. The issue was resolved in the Linux kernel stable tree.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators running kernels with AMD CCP cryptographic acceleration enabled; security teams tracking kernel memory safety issues; organizations relying on hardware crypto offload on AMD platforms

Technical summary

The vulnerability exists in the AMD CCP (Cryptographic Coprocessor Platform) driver within the Linux kernel's crypto subsystem. A local pointer variable annotated with `__cleanup(kfree)` causes the compiler-generated cleanup code to pass the address of the local variable (on the stack) to kfree, rather than the heap address stored in that variable. This occurs because `__cleanup` passes the address of the annotated variable, and kfree's `void *` parameter type accepts the `struct ** ` type without complaint. The `__free(kfree)` attribute is the correct alternative, as it dereferences the pointer to obtain the actual allocated address. The code compiled successfully due to type compatibility between `void *` and the pointer-to-pointer type, masking the error until runtime crash.

Defensive priority

medium

Recommended defensive actions

  • Review Linux kernel configurations to identify systems using the AMD CCP crypto driver (CONFIG_CRYPTO_DEV_CCP)
  • Apply kernel updates containing the referenced stable commits when available from distribution maintainers
  • Monitor vendor security advisories for kernel package updates addressing this issue
  • Consider disabling AMD CCP hardware acceleration temporarily if crash conditions are observed and patches are unavailable, accepting potential performance impact

Evidence notes

The CVE description and kernel.org commit references confirm the vulnerability is a coding error in cleanup attribute usage within the crypto/ccp driver. The fix involves changing `__cleanup(kfree)` to `__free(kfree)` to ensure proper heap memory deallocation. No CVSS score or severity has been assigned by NVD as of the modified date.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45959 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45959

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45959 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45959

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/90f9090e3e744a8fe3bb6fa0e61f577347728b0b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9a3ace9b010ffd8c422c97844ae152f7c53d6b18

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d5abcc33ee76bc26d58b39dc1a097e43a99dd438

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.