CVE-2026-68179
Received Received - Intake

Mutex Unlock Bug in Linux Kernel NSM Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsm_dev on post-lock error paths nsm_dev_ioctl() jumps to the common out label even when the initial copy_from_user() fails before nsm->lock has been taken. The error path then blindly unlocks a mutex that was never acquired. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the miscdevice ioctl entry and the pre-lock copy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing NSM_IOCTL_RAW with an invalid user pointer. That failure reaches the shared out label before mutex_lock(&nsm->lock). Lockdep reported: WARNING: bad unlock balance detected! exploit/193 is trying to release lock (&global_nsm.lock) at: nsm_dev_ioctl+0x5f/0xcf [vuln_msv] but there are no more locks to release! no locks held by exploit/193. Return immediately on the pre-lock copy_from_user() failure and keep the common unlock label for the post-lock paths only.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68179
EUVD
EUVD-2026-55280

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's misc subsystem, specifically in the NSM (Notification Service Module) device driver. It involves a flaw in the nsm_dev_ioctl() function where an error path incorrectly attempts to unlock a mutex that was never locked. This happens when a copy_from_user() operation fails before acquiring the lock, causing a mismatch in lock/unlock operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's nsm_dev_ioctl() function and involves improper mutex unlocking. Detection requires kernel-level analysis or static analysis tools. Check for kernel logs showing 'bad unlock balance' warnings from lockdep. Use commands like 'dmesg | grep -i lock' or 'cat /proc/kmsg' to monitor lock-related issues.

Impact Analysis

This vulnerability could lead to kernel memory corruption or crashes due to improper lock handling. An attacker could exploit this to cause a denial of service (system freeze or reboot) or potentially escalate privileges on a vulnerable system running the affected Linux kernel version.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patching is not immediately possible, restrict access to the miscdevice ioctl interface via kernel module restrictions or SELinux policies. Monitor for lockdep warnings indicating mutex imbalance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart