CVE-2026-68328

Received Received - Intake

Resource Mutex Allocation Failure in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfp: Check resource mutex allocation nfp_cpp_resource_find() allocates a CPP mutex handle for the matching resource-table entry and then reports success. nfp_resource_try_acquire() immediately passes that handle to nfp_cpp_mutex_trylock(). However, nfp_cpp_mutex_alloc() returns NULL on failure. If that happens for a matching table entry, the resource lookup still returns success and the following trylock dereferences a NULL mutex pointer while opening the resource. nfp_resource_acquire() already treats failure to allocate the table mutex as -ENOMEM. Do the same for the resource mutex and fail the lookup before publishing the rest of the resource handle. This issue was found by a static analysis checker and confirmed by manual source review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68328

EUVD

EUVD-2026-55429

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	nfp	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of mutex allocation in the nfp driver. The function nfp_cpp_resource_find() allocates a mutex handle but does not check if the allocation fails. If allocation fails, it returns success, leading to a NULL pointer dereference in nfp_cpp_mutex_trylock() when trying to lock the resource.

Detection Guidance

This vulnerability is specific to the Linux kernel's nfp driver and requires static analysis or manual source code review for detection. No direct commands can detect it as it involves a NULL pointer dereference in mutex handling.

Impact Analysis

This vulnerability could cause a system crash or instability if exploited, as it leads to a NULL pointer dereference. It may also allow unauthorized access or denial of service if an attacker triggers the faulty mutex handling.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a low-level Linux kernel mutex allocation issue in the nfp driver. Compliance impacts would depend on system-specific configurations and usage rather than this specific flaw.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor vendor advisories for updates to the nfp driver and kernel versions. If affected, avoid using the nfp driver until patched.

Hi! I’m here to help you understand CVE-2026-68328. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70