CVE-2026-68166

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68166", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.372Z", "datePublished": "2026-08-10T11:59:34.576Z", "dateUpdated": "2026-11-06T16:45:00.223Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:02.309Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: prevent registration of special VMAs\n\nVova Tokarev says:\n\n userfaultfd allows registration on shadow stack VMAs. With userfaultfd\n access, you can register on the shadow stack, discard a page ... and\n inject a page with chosen return addresses via UFFDIO_COPY.\n\nUpdate vma_can_userfault() to reject VM_SHADOW_STACK.\n\nWhile on it, also reject VM_SPECIAL so that if a driver would implement\nvm_uffd_ops, it wouldn't be possible to register special VMAs with\nuserfaultfd.\n\nSince VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude\nhugetlb VMAs from the check for VM_SPECIAL."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/userfaultfd.c"], "versions": [{"version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "d974b4b786214883bd8e56bda10b454c80fd6205", "status": "affected", "versionType": "git"}, {"version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "495a28d5a100be1b232633f4c2dcc42ba10b3796", "status": "affected", "versionType": "git"}, {"version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "165613191ad9d034bf17c00e3a142f9561597ec5", "status": "affected", "versionType": "git"}, {"version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "0c26202b157f1efc3cd2f26f5c30f59b508a6a5d", "status": "affected", "versionType": "git"}, {"version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "3c58f641e813c3c71039f8fd4d4e2a3aab713288", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/userfaultfd.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d974b4b786214883bd8e56bda10b454c80fd6205"}, {"url": "https://git.kernel.org/stable/c/495a28d5a100be1b232633f4c2dcc42ba10b3796"}, {"url": "https://git.kernel.org/stable/c/165613191ad9d034bf17c00e3a142f9561597ec5"}, {"url": "https://git.kernel.org/stable/c/0c26202b157f1efc3cd2f26f5c30f59b508a6a5d"}, {"url": "https://git.kernel.org/stable/c/3c58f641e813c3c71039f8fd4d4e2a3aab713288"}], "title": "userfaultfd: prevent registration of special VMAs", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68166", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:43:33.609914Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:45:00.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68166", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:43:33.609914Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:43:35.171Z"}}], "cna": {"title": "userfaultfd: prevent registration of special VMAs", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "d974b4b786214883bd8e56bda10b454c80fd6205", "versionType": "git"}, {"status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "495a28d5a100be1b232633f4c2dcc42ba10b3796", "versionType": "git"}, {"status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "165613191ad9d034bf17c00e3a142f9561597ec5", "versionType": "git"}, {"status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "0c26202b157f1efc3cd2f26f5c30f59b508a6a5d", "versionType": "git"}, {"status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "lessThan": "3c58f641e813c3c71039f8fd4d4e2a3aab713288", "versionType": "git"}], "programFiles": ["mm/userfaultfd.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"status": "unaffected", "version": "0", "lessThan": "6.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.153", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.105", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/userfaultfd.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d974b4b786214883bd8e56bda10b454c80fd6205"}, {"url": "https://git.kernel.org/stable/c/495a28d5a100be1b232633f4c2dcc42ba10b3796"}, {"url": "https://git.kernel.org/stable/c/165613191ad9d034bf17c00e3a142f9561597ec5"}, {"url": "https://git.kernel.org/stable/c/0c26202b157f1efc3cd2f26f5c30f59b508a6a5d"}, {"url": "https://git.kernel.org/stable/c/3c58f641e813c3c71039f8fd4d4e2a3aab713288"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: prevent registration of special VMAs\n\nVova Tokarev says:\n\n userfaultfd allows registration on shadow stack VMAs. With userfaultfd\n access, you can register on the shadow stack, discard a page ... and\n inject a page with chosen return addresses via UFFDIO_COPY.\n\nUpdate vma_can_userfault() to reject VM_SHADOW_STACK.\n\nWhile on it, also reject VM_SPECIAL so that if a driver would implement\nvm_uffd_ops, it wouldn't be possible to register special VMAs with\nuserfaultfd.\n\nSince VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude\nhugetlb VMAs from the check for VM_SPECIAL."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.153", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.105", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.44", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:02.309Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68166", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:45:00.223Z", "dateReserved": "2026-07-30T09:28:09.372Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-10T11:59:34.576Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/userfaultfd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d974b4b786214883bd8e56bda10b454c80fd6205", "status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "versionType": "git"}, {"lessThan": "495a28d5a100be1b232633f4c2dcc42ba10b3796", "status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "versionType": "git"}, {"lessThan": "165613191ad9d034bf17c00e3a142f9561597ec5", "status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "versionType": "git"}, {"lessThan": "0c26202b157f1efc3cd2f26f5c30f59b508a6a5d", "status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "versionType": "git"}, {"lessThan": "3c58f641e813c3c71039f8fd4d4e2a3aab713288", "status": "affected", "version": "54007f818206dc27309ca423df4c87dd160a7208", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/userfaultfd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.153", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: prevent registration of special VMAs\n\nVova Tokarev says:\n\n userfaultfd allows registration on shadow stack VMAs. With userfaultfd\n access, you can register on the shadow stack, discard a page ... and\n inject a page with chosen return addresses via UFFDIO_COPY.\n\nUpdate vma_can_userfault() to reject VM_SHADOW_STACK.\n\nWhile on it, also reject VM_SPECIAL so that if a driver would implement\nvm_uffd_ops, it wouldn't be possible to register special VMAs with\nuserfaultfd.\n\nSince VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude\nhugetlb VMAs from the check for VM_SPECIAL."}], "id": "CVE-2026-68166", "lastModified": "2026-11-06T17:19:20.417", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68166", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:43:33.609914Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:20:03.110", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0c26202b157f1efc3cd2f26f5c30f59b508a6a5d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/165613191ad9d034bf17c00e3a142f9561597ec5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c58f641e813c3c71039f8fd4d4e2a3aab713288"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/495a28d5a100be1b232633f4c2dcc42ba10b3796"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d974b4b786214883bd8e56bda10b454c80fd6205"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation", "id": "2513167", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513167"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nuserfaultfd: prevent registration of special VMAs\nVova Tokarev says:\nuserfaultfd allows registration on shadow stack VMAs. With userfaultfd\naccess, you can register on the shadow stack, discard a page ... and\ninject a page with chosen return addresses via UFFDIO_COPY.\nUpdate vma_can_userfault() to reject VM_SHADOW_STACK.\nWhile on it, also reject VM_SPECIAL so that if a driver would implement\nvm_uffd_ops, it wouldn't be possible to register special VMAs with\nuserfaultfd.\nSince VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude\nhugetlb VMAs from the check for VM_SPECIAL.", "A flaw was found in the Linux kernel's userfaultfd mechanism. A local attacker with userfaultfd access could register on shadow stack Virtual Memory Areas (VMAs). By discarding a page and injecting a page with chosen return addresses, an attacker could achieve arbitrary code execution. This vulnerability arises from the improper handling of special VMAs, including shadow stacks, allowing for manipulation of memory regions."], "name": "CVE-2026-68166", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T11:59:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68166\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68166\nhttps://git.kernel.org/stable/c/0c26202b157f1efc3cd2f26f5c30f59b508a6a5d\nhttps://git.kernel.org/stable/c/165613191ad9d034bf17c00e3a142f9561597ec5\nhttps://git.kernel.org/stable/c/3c58f641e813c3c71039f8fd4d4e2a3aab713288"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[54007f818206dc27309ca423df4c87dd160a7208,165613191ad9d034bf17c00e3a142f9561597ec5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[54007f818206dc27309ca423df4c87dd160a7208,0c26202b157f1efc3cd2f26f5c30f59b508a6a5d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[54007f818206dc27309ca423df4c87dd160a7208,3c58f641e813c3c71039f8fd4d4e2a3aab713288)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T17:00:03.444072+00:00", "updated": "2026-08-13T09:45:03.656221+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}