A newly published Linux kernel vulnerability, tracked as CVE-2026-63805, patches a driver bug that can crash IBM Power systems running cryptographic workloads. The flaw, disclosed on July 19, 2026, poses no risk to Windows PCs, Windows Server, or WSL 2 environments. Only Linux administrators managing IBM POWER hardware with the NX crypto acceleration driver enabled need to apply the fix to prevent kernel oops events.
The Bug: A Type Mismatch in NX Crypto Teardown
The vulnerability lives inside the nx-crypto driver, which accelerates AES and SHA-2 operations on IBM PowerPC Nest (NX) hardware. The problem appears when the kernel tears down a cryptographic context after an AF_ALG socket closes. In the driver’s cleanup function nx_crypto_ctx_shash_exit, the code passes a pointer of type nx_crypto_ctx * to nx_crypto_ctx_exit, but that function was defined to expect a crypto_tfm *. That type mismatch leads to an invalid memory access. The kernel then interprets an unrelated structure as a crypto_tfm, dereferences a bad address, and hits an “Unable to handle kernel data access” oops.
A call trace supplied with the fix shows the cascade: nx_crypto_ctx_shash_exit → crypto_shash_exit_tfm → crypto_destroy_tfm → af_alg_release → sock_close → __fput. The trigger was surprisingly mundane: the hardlink utility opportunistically uses AF_ALG, and when it closed the socket, the bad teardown logic fired. A second, nearly identical bug exists in nx_crypto_ctx_skcipher_exit but reportedly caused no field crashes because that code path was rarely exercised.
Who Is Affected (and Who Isn’t)
The driver at the heart of CVE-2026-63805 is hardware-specific. It compiles only for PowerPC architectures and activates only on IBM Power systems where the kernel configuration includes CONFIG_CRYPTO_DEV_NX. No x86-64 system—whether running Windows, a generic Linux distribution, or WSL 2—contains this driver.
| System Type | Affected? | Action Required |
|---|---|---|
| Windows 11, Windows 10, Windows Server (all architectures) | No | None |
| Windows Subsystem for Linux 2 (x86-64) | No | None |
| Linux on Intel or AMD servers | No | None |
Linux on IBM Power with nx_crypto module loaded |
Yes | Apply kernel update |
Linux on IBM Power without nx_crypto |
No, but verify | Confirm driver is absent |
Affected Linux kernel versions span from 5.5 through the unstable 7.2-rc1 branch. Fixed stable kernels are already available:
- Linux 6.18.38 for the 6.18 series
- Linux 7.1.3 for the 7.1 series
- Linux 7.2-rc1 includes the original upstream correction for the development line
What It Means for Windows Admins
For the vast Windows user base, this CVE is a non-event. The nx-crypto bug is purely a Linux kernel driver defect on IBM POWER hardware. A standard Windows 11 laptop, an Azure VM backed by Intel or AMD processors, or a WSL 2 distribution pulled from the Microsoft Store all run on x86-64 CPUs and lack the powerpc-specific driver entirely.
The only scenario where a Windows administrator needs to care is one where they manage a mixed estate—for example, connecting from a Windows workstation via SSH or Windows Admin Center to IBM Power Linux servers. In that case, the CVE belongs on the Linux patch-management queue, not the Windows endpoint queue. Treat this as a platform-boundary issue: Windows remains unaffected, but your Power Linux servers may need a kernel update.
How We Got Here
IBM’s NX cryptographic acceleration hardware has been supported in the mainline Linux kernel since version 4.11, with the modern nx-crypto driver evolving through several rewrites. The type-handling mistake that CVE-2026-63805 addresses was introduced when the driver added support for shash (synchronous hash) operations several years ago. For all that time, the bug lay dormant because most workloads using the NX acceleration went through the asynchronous interface, not the shash wrapper.
The bug surfaced only recently when a user observed a kernel oops during routine process cleanup. The hardlink utility, which conserves disk space by finding identical files and hardlinking them together, had started using AF_ALG on modern Linux distributions. When it closed its socket, the kernel walked into the broken teardown code. Kernel developers quickly crafted a minimal fix: change the argument type of nx_crypto_ctx_exit to accept the pointer it actually receives, and remove the erroneous crypto_tfm_ctx conversion. The patch landed in the upstream mainline and was then cherry-picked into multiple stable branches.
On July 19, 2026, the National Vulnerability Database published the record, and Microsoft’s Security Response Center indexed it in its own advisory database—an automatic step that can confuse Windows administrators who assume every CVE in the MSRC feed applies to them.
What to Do Now
For IBM Power Linux Administrators
Run through these checks to determine if your hosts are exposed:
- Confirm architecture: Execute
uname -m. Output ofppc64orppc64lemeans you are on POWER hardware. - Check for the NX driver: Run
lsmod | grep nx_crypto. If the module appears, your system is using NX acceleration and is affected. - Review your kernel version. Compare it against your distribution’s advisory, not just the upstream numbers. For example, Red Hat Enterprise Linux may deliver the fix in its own kernel package (
kernel-4.18.0-553.el8_10) that does not match the upstream 6.18.38 version string. - Apply the update. Use your standard patch management tools (
yum update,apt upgrade,zypper patch) to install a kernel that contains the backport. The relevant commit IDs for verification are:
-8d8507a457667f23477a15496b91908a5b5b7cf3(stable 7.1)
-833033e6e55acf11304ff7bbbdf18351d139c281(stable 6.18)
-4e67f504ee9ded15e256b64f4fde150e917381d7(mainline) - Reboot to load the new kernel.
- Validate. After patching, you can test the former crash path by executing a tool like
hardlinkon a test directory while monitoring kernel logs. Absence of a new oops confirms the fix.
For Everyone Else
Simply acknowledge that CVE-2026-63805 does not apply to your environment. If you use vulnerability scanners, suppress or override the finding for Windows, generic x86 Linux, and WSL 2 hosts to avoid alert fatigue. Document the architectural exclusion in your patch management records.
Outlook
As of this writing, NVD has not assigned a CVSS v3 or v4 severity score, nor has it linked a CWE weakness enumeration. The absence of a score does not mean the bug is low risk—it simply reflects that analysis is still pending. However, given the narrow hardware scope and the lack of any privilege escalation or remote exploitation path, the practical severity for affected systems is medium at most. Stability defects that crash the kernel can still cause denial-of-service conditions, so IBM Power Linux shops should not delay patching.
No public reports of exploitation have surfaced, but the details are now public through the NVD and kernel.org. With the fix already integrated into the 6.18.38 and 7.1.3 stable kernels, the window of opportunity for an attacker to trigger the oops on an unpatched Power Linux system is closing. Patch now, and this CVE becomes a footnote in your platform’s security history.