In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree
Annotating a local pointer variable, which will be assigned with the
kmalloc-family functions, with the `__cleanup(kfree)` attribute will
make the address of the local variable, rather than the address returned
by kmalloc, passed to kfree directly and lead to a crash due to invalid
deallocation of stack address. According to other places in the repo,
the correct usage should be `__free(kfree)`. The code coincidentally
compiled because the parameter type `void *` of kfree is compatible with
the desired type `struct { ... } **`.
References
Configurations
Configuration 1 (hide)
|
History
16 Jun 2026, 02:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/90f9090e3e744a8fe3bb6fa0e61f577347728b0b - Patch | |
| References | () https://git.kernel.org/stable/c/9a3ace9b010ffd8c422c97844ae152f7c53d6b18 - Patch | |
| References | () https://git.kernel.org/stable/c/d5abcc33ee76bc26d58b39dc1a097e43a99dd438 - Patch | |
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-476 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
30 May 2026, 11:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
27 May 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 14:17
Updated : 2026-06-16 02:32
NVD link : CVE-2026-45959
Mitre link : CVE-2026-45959
CVE.ORG link : CVE-2026-45959
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference