CVE-2026-45959

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the kmalloc-family functions, with the `__cleanup(kfree)` attribute will make the address of the local variable, rather than the address returned by kmalloc, passed to kfree directly and lead to a crash due to invalid deallocation of stack address. According to other places in the repo, the correct usage should be `__free(kfree)`. The code coincidentally compiled because the parameter type `void *` of kfree is compatible with the desired type `struct { ... } **`.

Affected products

Kernel, Linux, Linux-Allwinner-5.19, Linux-Aws, Linux-Aws-5.0, Linux-Aws-5.11, Linux-Aws-5.13, Linux-Aws-5.19

Linux Linux Kernel

< 6.18.14, 6.19.4

CVSS 3.1

7.8 HIGH

EPSS

0.1% (3th percentile)

Weakness

CWE-476

NVD status

Analyzed

Published

2026-05-27

No exploit for CVE-2026-45959 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.