CVE-2026-68144

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68144", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.370Z", "datePublished": "2026-08-10T11:59:08.437Z", "dateUpdated": "2026-10-19T20:58:53.730Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:30:06.882Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet: pep: fix use-after-free in pep_get_sb()\n\npep_get_sb() doesn't consider that pskb_may_pull() might have relocated\nthe skb data, and continue to access the older pointer, causing UAF.\n\nReproduced under KASAN:\n\n BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0\n Read of size 1 at addr ff11000105510f50 by task repro/157\n pep_get_sb+0x234/0x3b0\n pipe_handler_do_rcv+0x5f7/0xa10\n pep_do_rcv+0x203/0x410\n __sk_receive_skb+0x471/0x4a0\n phonet_rcv+0x5b3/0x6c0\n __netif_receive_skb+0xcc/0x1d0\n\nRefetch the header with skb_header_pointer() after pskb_may_pull(), so\nthe possibly stale pointer is no longer dereferenced. There are better\nways to solve this, but, this is the less instrusive one."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is hit in phonet_rcv() via __netif_receive_skb() when processing inbound Phonet pipe packets on a netdev; on modem-equipped phones this path is reachable from the cellular/BT-facing modem link without local access.\nAC:L - The attacker fully controls crafted TLV sb_len values in Phonet pipe messages to deterministically force pskb_may_pull() skb head reallocation; no race or victim-specific state beyond an existing/connecting pipe socket is required.\nPR:N - Exploitation requires only delivering a malformed Phonet packet to a listening/connecting pipe endpoint; phonet_rcv() performs no authentication or capability checks before delivering to pep_do_rcv() and pep_get_sb().\nUI:N - No end-user action is needed; triggering only requires a background phonet pipe listener or an in-progress connect/accept on affected Nokia/modem platforms where phonet daemons run continuously.\nS:U - Impact is confined to kernel memory/process integrity on the affected host; successful exploitation yields local privilege escalation within the same kernel security domain, not a cross-VM or cross-container boundary escape.\nC:H - Confirmed slab use-after-free read in pep_get_sb(); stale post-realloc pointer dereference can leak adjacent heap contents and is a standard primitive for arbitrary kernel memory disclosure.\nI:H - Use-after-free on skb header memory enables heap grooming and control of freed object contents, providing a well-established path to arbitrary kernel writes and code execution beyond the immediate one-byte read.\nA:H - KASAN reproduced a slab use-after-free oops in pep_get_sb() during packet receive; even without full exploit development, malformed Phonet pipe packets can reliably panic or hang the kernel on affected systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/phonet/pep.c"], "versions": [{"version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "c4a52cb4da8d57d060b1d52085d25147a238dac2", "status": "affected", "versionType": "git"}, {"version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "df198743859fefba2f824115f8151dd62d7ad6d8", "status": "affected", "versionType": "git"}, {"version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "1d81e19fc57a5ee55b4497d01bc0510d76fb9578", "status": "affected", "versionType": "git"}, {"version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "8d931a75a38b9bb584a4071f5ebbd52755fc35ee", "status": "affected", "versionType": "git"}, {"version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "17f78c0c0d41d738ee236eb6e841e39395188054", "status": "affected", "versionType": "git"}, {"version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "a48a889b60f73edb0399a8b08284a2ab0bd0295f", "status": "affected", "versionType": "git"}, {"version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "25e3641beb51333bfbb155af2fd2573a61113af2", "status": "affected", "versionType": "git"}, {"version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "0f71f852a96af9685858ce59fda34ecbf85c283d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/phonet/pep.c"], "versions": [{"version": "2.6.28", "status": "affected"}, {"version": "0", "lessThan": "2.6.28", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c4a52cb4da8d57d060b1d52085d25147a238dac2"}, {"url": "https://git.kernel.org/stable/c/df198743859fefba2f824115f8151dd62d7ad6d8"}, {"url": "https://git.kernel.org/stable/c/1d81e19fc57a5ee55b4497d01bc0510d76fb9578"}, {"url": "https://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee"}, {"url": "https://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054"}, {"url": "https://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f"}, {"url": "https://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2"}, {"url": "https://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d"}], "title": "phonet: pep: fix use-after-free in pep_get_sb()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:44:46.818096Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:58:53.730Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:44:46.818096Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:44:47.377Z"}}], "cna": {"title": "phonet: pep: fix use-after-free in pep_get_sb()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is hit in phonet_rcv() via __netif_receive_skb() when processing inbound Phonet pipe packets on a netdev; on modem-equipped phones this path is reachable from the cellular/BT-facing modem link without local access.\nAC:L - The attacker fully controls crafted TLV sb_len values in Phonet pipe messages to deterministically force pskb_may_pull() skb head reallocation; no race or victim-specific state beyond an existing/connecting pipe socket is required.\nPR:N - Exploitation requires only delivering a malformed Phonet packet to a listening/connecting pipe endpoint; phonet_rcv() performs no authentication or capability checks before delivering to pep_do_rcv() and pep_get_sb().\nUI:N - No end-user action is needed; triggering only requires a background phonet pipe listener or an in-progress connect/accept on affected Nokia/modem platforms where phonet daemons run continuously.\nS:U - Impact is confined to kernel memory/process integrity on the affected host; successful exploitation yields local privilege escalation within the same kernel security domain, not a cross-VM or cross-container boundary escape.\nC:H - Confirmed slab use-after-free read in pep_get_sb(); stale post-realloc pointer dereference can leak adjacent heap contents and is a standard primitive for arbitrary kernel memory disclosure.\nI:H - Use-after-free on skb header memory enables heap grooming and control of freed object contents, providing a well-established path to arbitrary kernel writes and code execution beyond the immediate one-byte read.\nA:H - KASAN reproduced a slab use-after-free oops in pep_get_sb() during packet receive; even without full exploit development, malformed Phonet pipe packets can reliably panic or hang the kernel on affected systems."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "c4a52cb4da8d57d060b1d52085d25147a238dac2", "versionType": "git"}, {"status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "df198743859fefba2f824115f8151dd62d7ad6d8", "versionType": "git"}, {"status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "1d81e19fc57a5ee55b4497d01bc0510d76fb9578", "versionType": "git"}, {"status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "8d931a75a38b9bb584a4071f5ebbd52755fc35ee", "versionType": "git"}, {"status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "17f78c0c0d41d738ee236eb6e841e39395188054", "versionType": "git"}, {"status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "a48a889b60f73edb0399a8b08284a2ab0bd0295f", "versionType": "git"}, {"status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "25e3641beb51333bfbb155af2fd2573a61113af2", "versionType": "git"}, {"status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "lessThan": "0f71f852a96af9685858ce59fda34ecbf85c283d", "versionType": "git"}], "programFiles": ["net/phonet/pep.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.28"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.28", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/phonet/pep.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c4a52cb4da8d57d060b1d52085d25147a238dac2"}, {"url": "https://git.kernel.org/stable/c/df198743859fefba2f824115f8151dd62d7ad6d8"}, {"url": "https://git.kernel.org/stable/c/1d81e19fc57a5ee55b4497d01bc0510d76fb9578"}, {"url": "https://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee"}, {"url": "https://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054"}, {"url": "https://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f"}, {"url": "https://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2"}, {"url": "https://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet: pep: fix use-after-free in pep_get_sb()\n\npep_get_sb() doesn't consider that pskb_may_pull() might have relocated\nthe skb data, and continue to access the older pointer, causing UAF.\n\nReproduced under KASAN:\n\n BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0\n Read of size 1 at addr ff11000105510f50 by task repro/157\n pep_get_sb+0x234/0x3b0\n pipe_handler_do_rcv+0x5f7/0xa10\n pep_do_rcv+0x203/0x410\n __sk_receive_skb+0x471/0x4a0\n phonet_rcv+0x5b3/0x6c0\n __netif_receive_skb+0xcc/0x1d0\n\nRefetch the header with skb_header_pointer() after pskb_may_pull(), so\nthe possibly stale pointer is no longer dereferenced. There are better\nways to solve this, but, this is the less instrusive one."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.148", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.101", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "2.6.28"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:30:06.882Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68144", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:58:53.730Z", "dateReserved": "2026-07-30T09:28:09.370Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-10T11:59:08.437Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/phonet/pep.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c4a52cb4da8d57d060b1d52085d25147a238dac2", "status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "versionType": "git"}, {"lessThan": "df198743859fefba2f824115f8151dd62d7ad6d8", "status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "versionType": "git"}, {"lessThan": "1d81e19fc57a5ee55b4497d01bc0510d76fb9578", "status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "versionType": "git"}, {"lessThan": "8d931a75a38b9bb584a4071f5ebbd52755fc35ee", "status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "versionType": "git"}, {"lessThan": "17f78c0c0d41d738ee236eb6e841e39395188054", "status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "versionType": "git"}, {"lessThan": "a48a889b60f73edb0399a8b08284a2ab0bd0295f", "status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "versionType": "git"}, {"lessThan": "25e3641beb51333bfbb155af2fd2573a61113af2", "status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "versionType": "git"}, {"lessThan": "0f71f852a96af9685858ce59fda34ecbf85c283d", "status": "affected", "version": "9641458d3ec42def729fde64669abf07f3220cd5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/phonet/pep.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.28"}, {"lessThan": "2.6.28", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet: pep: fix use-after-free in pep_get_sb()\n\npep_get_sb() doesn't consider that pskb_may_pull() might have relocated\nthe skb data, and continue to access the older pointer, causing UAF.\n\nReproduced under KASAN:\n\n BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0\n Read of size 1 at addr ff11000105510f50 by task repro/157\n pep_get_sb+0x234/0x3b0\n pipe_handler_do_rcv+0x5f7/0xa10\n pep_do_rcv+0x203/0x410\n __sk_receive_skb+0x471/0x4a0\n phonet_rcv+0x5b3/0x6c0\n __netif_receive_skb+0xcc/0x1d0\n\nRefetch the header with skb_header_pointer() after pskb_may_pull(), so\nthe possibly stale pointer is no longer dereferenced. There are better\nways to solve this, but, this is the less instrusive one."}], "id": "CVE-2026-68144", "lastModified": "2026-10-19T21:17:54.457", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68144", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:44:46.818096Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:20:00.217", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d81e19fc57a5ee55b4497d01bc0510d76fb9578"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c4a52cb4da8d57d060b1d52085d25147a238dac2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df198743859fefba2f824115f8151dd62d7ad6d8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: Linux kernel Phonet: Memory corruption vulnerability in pep_get_sb() function", "id": "2513242", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513242"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nphonet: pep: fix use-after-free in pep_get_sb()\npep_get_sb() doesn't consider that pskb_may_pull() might have relocated\nthe skb data, and continue to access the older pointer, causing UAF.\nReproduced under KASAN:\nBUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0\nRead of size 1 at addr ff11000105510f50 by task repro/157\npep_get_sb+0x234/0x3b0\npipe_handler_do_rcv+0x5f7/0xa10\npep_do_rcv+0x203/0x410\n__sk_receive_skb+0x471/0x4a0\nphonet_rcv+0x5b3/0x6c0\n__netif_receive_skb+0xcc/0x1d0\nRefetch the header with skb_header_pointer() after pskb_may_pull(), so\nthe possibly stale pointer is no longer dereferenced. There are better\nways to solve this, but, this is the less instrusive one.", "A flaw was found in the Linux kernel's Phonet subsystem. When processing Phonet packets, a use-after-free vulnerability exists in the `pep_get_sb()` function. This occurs because the function does not correctly handle situations where packet data might be relocated in memory, leading to the use of an outdated memory address. A local attacker could exploit this to cause a system crash (denial of service) or potentially execute arbitrary code, leading to a compromise of the system."], "name": "CVE-2026-68144", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T11:59:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68144\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68144\nhttps://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d\nhttps://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054\nhttps://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2\nhttps://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee\nhttps://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9641458d3ec42def729fde64669abf07f3220cd5,8d931a75a38b9bb584a4071f5ebbd52755fc35ee)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9641458d3ec42def729fde64669abf07f3220cd5,17f78c0c0d41d738ee236eb6e841e39395188054)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9641458d3ec42def729fde64669abf07f3220cd5,a48a889b60f73edb0399a8b08284a2ab0bd0295f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9641458d3ec42def729fde64669abf07f3220cd5,25e3641beb51333bfbb155af2fd2573a61113af2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9641458d3ec42def729fde64669abf07f3220cd5,0f71f852a96af9685858ce59fda34ecbf85c283d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.28"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.28)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T15:30:05.717774+00:00", "updated": "2026-08-14T00:00:04.149831+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}