CVE-2026-68176

Received Received - Intake

NULL Pointer Dereference in Linux Kernel mmiotrace

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev If the mmio_pipe_open() fails to find a PCI device, the hiter->dev will be assigned to NULL. The mmiotrace read() function dereferences the hiter->dev if hiter exists. Change the test of the read to not only check hiter being NULL, but also the hiter->dev before dereferencing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68176

EUVD

EUVD-2026-55277

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a NULL pointer dereference in the mmiotrace functionality. When the mmio_pipe_open() function fails to locate a PCI device, it sets hiter->dev to NULL. Later, the mmiotrace read() function may dereference this NULL pointer if hiter exists, potentially causing a system crash or other undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's mmiotrace functionality and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors related to mmiotrace or PCI device handling. Commands like dmesg | grep mmiotrace or journalctl -k | grep mmiotrace may help identify issues.

Impact Analysis

This vulnerability could lead to system instability, crashes, or unexpected behavior if exploited. It primarily affects systems using the Linux kernel with mmiotrace enabled, potentially causing denial-of-service conditions or data corruption.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local kernel issue involving a NULL dereference in the mmiotrace functionality, which could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this specific issue. If using a distribution kernel, update via your package manager (e.g., apt upgrade, yum update). For custom kernels, recompile with the fix applied. Disable mmiotrace if not needed via kernel boot parameters.

Hi! I’m here to help you understand CVE-2026-68176. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70