Linux Kernel EUVD-2026-45471

Exploitation requires local code execution on a PowerPC (POWER7+) system where the IBM NX hardware crypto driver (drivers/crypto/nx, nx-crypto module) is present and loaded, AND the ability to reach the kernel Crypto API via an AF_ALG hash (shash) socket - the crash occurs on transform teardown of the NX shash algorithm. The condition is concretely: use AF_ALG with a hash algorithm serviced by the NX shash driver, then close/destroy it (the exact path hit in the wild was hardlink(1) opportunistically using AF_ALG). Limiting factors: the flaw is architecture- and driver-specific (only NX-capable IBM POWER hosts with nx-crypto loaded are affected - the vast majority of x86/ARM Linux deployments are NOT), requires local access (AV:L) with low privileges (PR:L, i.e. an authenticated local user), and needs no user interaction. Systems without the NX accelerator or with nx-crypto unloaded are not exploitable via this path.

Signals are largely consistent and point to a genuine but bounded local issue. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8 (High) implying local, low-complexity, low-privilege access with full CIA impact; however the described behavior is a kernel oops/crash (denial of service) triggered via a legitimate userspace crypto path, so the modeled C:H/I:H - potential info disclosure or corruption from the bad kernel access - is plausible but not demonstrated in the input, which only shows a NULL-area-style fault. This is a notable conflict to flag: the tags say 'Information Disclosure' and CVSS asserts high confidentiality/integrity impact, yet the evidence provided is a reproducible crash, not leaked data or code execution - verify the actual impact with the maintainer before treating it as info-disclosure. EPSS is low at 0.17% (6th percentile), it is NOT in CISA KEV, and no POC is referenced, so exploitation pressure is minimal. No SSVC decision data was provided. Net: low-to-moderate operational priority - patch in normal cycle on POWER systems with the NX accelerator; not an emergency for the general fleet, and irrelevant to non-PowerPC deployments.

A local unprivileged user on an affected IBM POWER server with the NX crypto driver loaded opens an AF_ALG hash socket (directly or indirectly, as hardlink(1) does opportunistically) and lets the transform be destroyed; the flawed shash exit path dereferences a mis-typed pointer and oopses the kernel, crashing or destabilizing the host. No special tooling is required and no public POC is referenced, but any process able to reach the kernel Crypto API can reproduce it.