CVE-2026-68178

Received Received - Intake

Use-After-Free in Linux Kernel NSM Module

Publication date: 2026-08-10

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open misc_open() installs a misc driver's file operations with fops_get(), which pins file_operations::owner before replacing the file's f_op. The NSM misc device leaves nsm_dev_fops.owner unset, so opening /dev/nsm does not take a module reference on the nsm driver. If the driver is built as a module, an open file descriptor can therefore survive rmmod of the module that provides its ioctl callbacks. A later ioctl through that descriptor can call into unloaded module text. Set nsm_dev_fops.owner to THIS_MODULE so the misc core holds the module while any /dev/nsm file descriptor is open, matching the lifetime expectation for the installed file operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68178

EUVD

EUVD-2026-55279

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	nsm	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the NSM (Notification Service Module) misc device driver. When a file descriptor for /dev/nsm is opened, the driver does not properly maintain a reference to its module. This allows the module to be unloaded while the file descriptor remains open, leading to potential calls into unloaded module code via ioctl operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's NSM (Network Security Module) misc device driver. Detection requires checking if the kernel module is loaded and if the nsm_dev_fops.owner field is unset. No direct network detection commands are applicable. Check kernel logs for module unloading issues or unexpected ioctl calls after rmmod.

Impact Analysis

If exploited, this flaw could allow an attacker to execute arbitrary code in the kernel by triggering an ioctl call on an open file descriptor after the module has been unloaded. This could lead to system crashes, privilege escalation, or unauthorized access depending on the kernel context.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue involving improper module pinning during device operations, which could lead to use-after-free scenarios. Compliance impacts would depend on system-specific configurations and mitigations rather than the vulnerability itself.

Mitigation Strategies

Apply the Linux kernel patch that sets nsm_dev_fops.owner to THIS_MODULE. If the module is not needed, unload it immediately using rmmod. Monitor kernel logs for any suspicious ioctl calls after module removal. Update to a patched kernel version if available.

Hi! I’m here to help you understand CVE-2026-68178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...