CVE-2026-68178
Received Received - Intake

Use-After-Free in Linux Kernel NSM Module

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open misc_open() installs a misc driver's file operations with fops_get(), which pins file_operations::owner before replacing the file's f_op. The NSM misc device leaves nsm_dev_fops.owner unset, so opening /dev/nsm does not take a module reference on the nsm driver. If the driver is built as a module, an open file descriptor can therefore survive rmmod of the module that provides its ioctl callbacks. A later ioctl through that descriptor can call into unloaded module text. Set nsm_dev_fops.owner to THIS_MODULE so the misc core holds the module while any /dev/nsm file descriptor is open, matching the lifetime expectation for the installed file operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68178
EUVD
EUVD-2026-55279

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel nsm *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the NSM (Notification Service Module) misc device driver. When a file descriptor for /dev/nsm is opened, the driver does not properly maintain a reference to its module. This allows the module to be unloaded while the file descriptor remains open, leading to potential calls into unloaded module code via ioctl operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's NSM (Network Security Module) misc device driver. Detection requires checking if the kernel module is loaded and if the nsm_dev_fops.owner field is unset. No direct network detection commands are applicable. Check kernel logs for module unloading issues or unexpected ioctl calls after rmmod.

Impact Analysis

If exploited, this flaw could allow an attacker to execute arbitrary code in the kernel by triggering an ioctl call on an open file descriptor after the module has been unloaded. This could lead to system crashes, privilege escalation, or unauthorized access depending on the kernel context.

Mitigation Strategies

Apply the Linux kernel patch that sets nsm_dev_fops.owner to THIS_MODULE. If the module is not needed, unload it immediately using rmmod. Monitor kernel logs for any suspicious ioctl calls after module removal. Update to a patched kernel version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68178. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart