CyberSecBulletin
CVE-2026-68107NVD status: Received

Linux: Time-of-check Time-of-use (TOCTOU) Race Condition

Published Updated By the CyberSecBulletin desk

CVE-2026-68107 is a high-severity time-of-check time-of-use (TOCTOU) race condition vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions bbbe6a2a8d8dc87243438d3ffea2083b52d882d9, ff6aa542d91d76a185f69bd1997b94a560ff5f6b, bd868c077f67589ed2a714307ceaade5f246e302 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to bbbe6a2a8d8dc87243438d3ffea2083b52d882d9 or ff6aa542d91d76a185f69bd1997b94a560ff5f6b or bd868c077f67589ed2a714307ceaade5f246e302 or c309626bf91fa0a0b583575654e6e14e81f818a3, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxcfdde9197ecd957281507be99af172671a57755c up to, but not including, bbbe6a2a8d8dc87243438d3ffea2083b52d882d9; 6dc4eddeb7e6cca7e1ab32cafbda79d06e652d84 up to, but not including, ff6aa542d91d76a185f69bd1997b94a560ff5f6b; 2b10cb58d7a3fd621ec9b2ba765a092e562ef998 up to, but not including, bd868c077f67589ed2a714307ceaade5f246e302; 2b10cb58d7a3fd621ec9b2ba765a092e562ef998 up to, but not including, c309626bf91fa0a0b583575654e6e14e81f818a3; 2b10cb58d7a3fd621ec9b2ba765a092e562ef998 up to, but not including, 3b4082fabc67c9780b06eb959e59dd92fa79c0f0; d19dd814b5b7dd9bfc288308a69cb29528f041fd; b1dc92f55b22a80ded8f0263c9ef4ba902303895; 6.6.107 up to, but not including, 6.6.148; and 4 more rangesbbbe6a2a8d8dc87243438d3ffea2083b52d882d9, ff6aa542d91d76a185f69bd1997b94a560ff5f6b, bd868c077f67589ed2a714307ceaade5f246e302, c309626bf91fa0a0b583575654e6e14e81f818a3, 3b4082fabc67c9780b06eb959e59dd92fa79c0f0, 6.6.148

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcn_v4_0_enc_find_ib_param() instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. (cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

How developers prevent this class of flaw

  • The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
  • When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
  • Limit the interleaving of operations on files from multiple processes.

More Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities (CWE-367)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities

Spotted an error? Tell us.