LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx

In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx The bounce buffers are allocated with __get_free_pages() using BOUNCE_BUFFER_ORDER (order 2 = 4 pages), but both the allocation error path and nx842_crypto_free_ctx() release the buffers with free_page(). Use free_pages() with the matching order instead.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-46068 is a Linux kernel memory-management flaw in the nx842 crypto code. Some allocated bounce-buffer pages were freed incorrectly, leaving memory behind. The public record does not provide CVSS, impact scoring, or evidence of exploitation, so urgency should be based on affected-kernel presence and nx842 usage.

Executive priority

Treat this as a patch-management item until vendor scoring clarifies impact. It does not currently justify emergency response based on the supplied evidence, but affected Linux systems should be remediated in the next appropriate kernel maintenance window.

Technical view

The nx842 crypto context allocated bounce buffers with __get_free_pages() at order 2, but error handling and context teardown used free_page(). The fix changes release logic to free_pages() with the matching order, preventing page leaks in nx842_crypto_alloc_ctx and nx842_crypto_free_ctx.

Likely exposure

Exposure appears limited to Linux systems running affected kernel builds where the nx842 crypto code is present or used. The source bundle lists Linux as affected but does not provide distribution package names, kernel configuration requirements, or deployment prevalence.

Exploitation context

No active exploitation is reported in the supplied sources, and the CVE is not listed as KEV. The record describes a memory leak caused by mismatched page allocation and free semantics, but it does not document an exploit path or attacker prerequisites.

Researcher notes

Evidence is sparse: no CVSS, CWE, exploitability notes, or distribution-specific advisories are included. Analysis should focus on affected kernel lineage, whether nx842 context allocation can be triggered locally or remotely in the environment, and whether vendor kernels have backported the stable commits.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable Linux fixes.
  • Check Linux distribution advisories for backported package versions.
  • Prioritize systems where nx842 crypto support is enabled or used.
  • If patching is delayed, request vendor-supported workaround guidance.
  • Schedule required reboots or kernel reload procedures through normal change control.

Validation and detection

  • Inventory Linux kernel versions across affected fleets.
  • Compare installed kernels with vendor advisories and stable fix backports.
  • Check whether nx842 crypto support is configured, loaded, or required.
  • Review kernel package changelogs for the referenced fix commits.
  • Confirm patched systems boot into the remediated kernel version.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46068 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxed70b479c2c0b6e1319f0cb2de19f1051be219a4, ed70b479c2c0b6e1319f0cb2de19f1051be219a4, ed70b479c2c0b6e1319f0cb2de19f1051be219a4, ed70b479c2c0b6e1319f0cb2de19f1051be219a4, ed70b479c2c0b6e1319f0cb2de19f1051be219a4unaffected
LinuxLinux4.2, 0, 6.6.141, 6.12.88, 6.18.27, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.