CVE-2026-68144

Received Received - Intake

Use-After-Free in Linux Kernel phonet pep_get_sb

Publication date: 2026-08-10

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pep_get_sb() pep_get_sb() doesn't consider that pskb_may_pull() might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0 Read of size 1 at addr ff11000105510f50 by task repro/157 pep_get_sb+0x234/0x3b0 pipe_handler_do_rcv+0x5f7/0xa10 pep_do_rcv+0x203/0x410 __sk_receive_skb+0x471/0x4a0 phonet_rcv+0x5b3/0x6c0 __netif_receive_skb+0xcc/0x1d0 Refetch the header with skb_header_pointer() after pskb_may_pull(), so the possibly stale pointer is no longer dereferenced. There are better ways to solve this, but, this is the less instrusive one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68144

EUVD

EUVD-2026-55527

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's phonet protocol implementation. The function pep_get_sb() fails to handle cases where pskb_may_pull() relocates skb data, leading to access of freed memory. This can cause system crashes or potential privilege escalation.

Detection Guidance

This vulnerability is specific to the Linux kernel's phonet protocol implementation and may require kernel debugging tools like KASAN to detect use-after-free conditions. Check kernel logs for KASAN errors or slab corruption messages. No direct detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to crash the system or execute arbitrary code with kernel privileges. Systems using vulnerable Linux kernel versions with phonet protocol enabled are at risk of denial-of-service or code execution attacks.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's phonet protocol implementation. It does not directly relate to data protection or privacy compliance standards like GDPR or HIPAA, as it is a low-level system bug rather than a data exposure or privacy violation.

Mitigation Strategies

Update your Linux kernel to the patched version that includes the fix for CVE-2026-68144. If immediate patching is not possible, consider disabling the phonet protocol module (CONFIG_PHONET) if not required.

Hi! I’m here to help you understand CVE-2026-68144. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...