Linux Kernel CVE-2026-63805

Vendor-released patch: upgrade to a fixed stable kernel - 6.18.38 or 7.1.3, or mainline 7.2-rc1 and later - which correct nx_crypto_ctx_exit to take the proper nx_crypto_ctx* and drop the erroneous crypto_tfm_ctx call. Apply the corresponding distribution kernel update that backports commits 4e67f504ee9ded15e256b64f4fde150e917381d7 / 8d8507a457667f23477a15496b91908a5b5b7cf3 / 833033e6e55acf11304ff7bbbdf18351d139c281 (git.kernel.org/stable). If immediate patching is not possible, the practical compensating control is to remove exposure of the NX shash path: blacklist/unload the nx-crypto module (e.g. modprobe nx-crypto is not loaded) on affected POWER systems so the kernel falls back to software crypto - trade-off is loss of hardware crypto acceleration and possible performance impact. Alternatively, restrict access to the AF_ALG interface, since that is the trigger surface: disable CONFIG_CRYPTO_USER_API_HASH / prevent AF_ALG socket use where feasible, or apply seccomp/LSM policy blocking AF_ALG for untrusted local processes - trade-off is breaking applications (like hardlink(1) or others) that opportunistically use AF_ALG. These controls only apply to PowerPC hosts with the NX accelerator; non-PPC systems are unaffected.