« Volver al listado

CVE-2026-68179

Estado: RecibidaAlta (8.4)—

In the Linux kernel, the following vulnerability has been resolved:

misc: nsm: only unlock nsm_dev on post-lock error paths

nsm_dev_ioctl() jumps to the common out label even when the initial copy_from_user() fails before nsm->lock has been taken. The error path then blindly unlocks a mutex that was never acquired.

This issue was found by our static analysis tool and then manually reviewed against the current tree.

The grounded PoC kept the miscdevice ioctl entry and the pre-lock copy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing NSM_IOCTL_RAW with an invalid user pointer. That failure reaches the shared out label before mutex_lock(&nsm->lock). Lockdep reported:

Leer descripción completaMostrar menos

Return immediately on the pre-lock copy_from_user() failure and keep the common unlock label for the post-lock paths only.

Detalles técnicos trazas, registros y código del informe original
  WARNING: bad unlock balance detected!
  exploit/193 is trying to release lock (&global_nsm.lock) at:
  nsm_dev_ioctl+0x5f/0xcf [vuln_msv]
  but there are no more locks to release!
  no locks held by exploit/193.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local sin interacción (AV:L/PR:N/UI:N) causa desbloqueo incorrecto de mutex, resultando en DoS por corrupción de sincronización del kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68179",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "lessThan": "4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "lessThan": "8f068342096b027181b168d91fef7ac7a2c64b25",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "lessThan": "f318f5a872cb9096536e759b23ae5c9873bb80ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "lessThan": "ce1fed11d18e163baf7f875152a33bf80f625c1a",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/misc/nsm.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/misc/nsm.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:04.847",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8f068342096b027181b168d91fef7ac7a2c64b25",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ce1fed11d18e163baf7f875152a33bf80f625c1a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f318f5a872cb9096536e759b23ae5c9873bb80ed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: nsm: only unlock nsm_dev on post-lock error paths\n\nnsm_dev_ioctl() jumps to the common out label even when the initial\ncopy_from_user() fails before nsm->lock has been taken.  The error path\nthen blindly unlocks a mutex that was never acquired.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the miscdevice ioctl entry and the pre-lock\ncopy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing\nNSM_IOCTL_RAW with an invalid user pointer.  That failure reaches the\nshared out label before mutex_lock(&nsm->lock).  Lockdep reported:\n\n  WARNING: bad unlock balance detected!\n  exploit/193 is trying to release lock (&global_nsm.lock) at:\n  nsm_dev_ioctl+0x5f/0xcf [vuln_msv]\n  but there are no more locks to release!\n  no locks held by exploit/193.\n\nReturn immediately on the pre-lock copy_from_user() failure and keep the\ncommon unlock label for the post-lock paths only."
    }
  ],
  "lastModified": "2026-08-17T05:18:19.590",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}