PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46068 Linux CVE debrief

A memory management bug in the Linux kernel's NX842 crypto driver causes bounce buffer leaks due to mismatched allocation and deallocation functions. The buffers are allocated with `__get_free_pages()` using order 2 (4 pages) but freed with `free_page()` instead of `free_pages()` with the correct order. This affects both the allocation error path and the `nx842_crypto_free_ctx()` cleanup function. The vulnerability is localized to the IBM Power NX842 compression accelerator driver (`drivers/crypto/nx/nx-842.c`).

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux on IBM Power systems with NX842 compression hardware enabled; kernel maintainers and distribution security teams tracking memory leak fixes in crypto drivers

Technical summary

The NX842 crypto driver in the Linux kernel incorrectly frees bounce buffers allocated with `__get_free_pages(order=2)` using `free_page()` instead of `free_pages()` with matching order. This mismatch causes 3 of 4 allocated pages to leak on both allocation failure paths and normal context teardown. The bug affects systems using IBM Power NX842 hardware compression acceleration. The fix replaces `free_page()` calls with `free_pages(addr, BOUNCE_BUFFER_ORDER)` to properly release all allocated pages. No privilege escalation or code execution path is described; impact is limited to memory exhaustion under sustained allocation pressure.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor vendor security advisories for backported fixes to long-term support kernels
  • Verify nx842 driver is in use on IBM Power systems before prioritizing deployment
  • Review systems for memory pressure indicators if running workloads utilizing NX842 hardware compression

Evidence notes

The vulnerability description and fix commits confirm this is a resource leak in kernel memory management, not an exploitable memory corruption issue. The bug was introduced by incorrect page deallocation semantics where higher-order allocations were paired with single-page frees, leaving 3 pages leaked per buffer. Five stable kernel commits are referenced, indicating backports to multiple maintained branches.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46068 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46068

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46068 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46068

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5c07962fed66e1238fad7635fa150570bd38b4c5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/80fd99d7c30ea889662d21f1b44d8fea4c83138d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/910bb34b801d39794e656f7d48414844b2bd354e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f17a4850d1ce7c11cba8b1830b9bfedfede878bb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.