CVE-2026-23344

crypto: ccp - Fix use-after-free on error path

View on CVE.org
Published Mar 25, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Fix use-after-free on error path

In the error path of sev_tsm_init_locked(), the code dereferences 't'
after it has been freed with kfree(). The pr_err() statement attempts
to access t->tio_en and t->tio_init_done after the memory has been
released.

Move the pr_err() call before kfree(t) to access the fields while the
memory is still valid.

This issue reported by Smatch static analyser

Analysis

AI-generated

Technical impact

The vulnerability is a use‑after‑free in the Linux kernel’s crypto subsystem. The error path of sev_tsm_init_locked() dereferences a structure that has already been freed with kfree(). Accessing t->tio_en and t->tio_init_done after the memory release causes a kernel memory fault, resulting in a crash and a denial of service.

Affected Systems

Linux kernel binaries compiled from the vulnerable source tree are affected, including kernel releases 6.19 and all 7.0 release candidates (rc1 through rc7).

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the flaw resides in kernel code and would generally require local privileged execution to trigger the error path. Even a single triggering event could crash the system, leading to a denial of service. The low EPSS suggests that widespread exploitation is unlikely at present.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a kernel update that contains the ccp use‑after‑free fix
  • If an update is not yet available, disable the ccp crypto module by unloading the module or compiling the kernel without it
  • Reboot the system to load the updated kernel or disabled module configuration

Generated by OpenCVE AI on April 28, 2026 at 22:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Weaknesses CWE-416
Type Values Removed Values Added
Weaknesses CWE-416
Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix use-after-free on error path In the error path of sev_tsm_init_locked(), the code dereferences 't' after it has been freed with kfree(). The pr_err() statement attempts to access t->tio_en and t->tio_init_done after the memory has been released. Move the pr_err() call before kfree(t) to access the fields while the memory is still valid. This issue reported by Smatch static analyser
Title crypto: ccp - Fix use-after-free on error path
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Linux
Published
Updated
May 11, 2026, 10:05 PM
Reserved
Jan 13, 2026, 3:37 PM

View source JSON

No data.

Status
Analyzed
Published
Mar 25, 2026, 11:16 AM
Modified
Jun 17, 2026, 10:21 AM

View source JSON

Severity
Public date
Mar 25, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Apr 28, 2026, 10:15 PM

JSON