Linux: Use After Free
CVE-2026-68148 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 965b5bc8cf5031225e057979ce660fec2bd5fbfc, 330249609b70778094a7a36f5b6bcfa6362121d4, deff41898a5ae3a47db5fa1896a494aa95efda5d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.09% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 965b5bc8cf5031225e057979ce660fec2bd5fbfc or 330249609b70778094a7a36f5b6bcfa6362121d4 or deff41898a5ae3a47db5fa1896a494aa95efda5d or 95376fe9c145be35566991df99c53134943d992f, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 22e9947a4b2ba255888541bd0111cf00b9b16586 up to, but not including, 965b5bc8cf5031225e057979ce660fec2bd5fbfc; 22e9947a4b2ba255888541bd0111cf00b9b16586 up to, but not including, 330249609b70778094a7a36f5b6bcfa6362121d4; 22e9947a4b2ba255888541bd0111cf00b9b16586 up to, but not including, deff41898a5ae3a47db5fa1896a494aa95efda5d; 22e9947a4b2ba255888541bd0111cf00b9b16586 up to, but not including, 95376fe9c145be35566991df99c53134943d992f; 22e9947a4b2ba255888541bd0111cf00b9b16586 up to, but not including, 466f187b501a5ac8e1ea2ccf3ccd5c46108d8830; 22e9947a4b2ba255888541bd0111cf00b9b16586 up to, but not including, b5fa40226e71c17847b9ff2816c6ca4133d0d994; 6.1 | 965b5bc8cf5031225e057979ce660fec2bd5fbfc, 330249609b70778094a7a36f5b6bcfa6362121d4, deff41898a5ae3a47db5fa1896a494aa95efda5d, 95376fe9c145be35566991df99c53134943d992f, 466f187b501a5ac8e1ea2ccf3ccd5c46108d8830, b5fa40226e71c17847b9ff2816c6ca4133d0d994 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: fscrypt: Add missing superblock check in find_or_insert_direct_key() The legacy 'fscrypt_direct_keys' table caches master keys that are used by v1 encryption policies that have FSCRYPT_POLICY_FLAG_DIRECT_KEY. It's just a global table for all filesystems (since the keys can be provided by the legacy process-subscribed keyrings mechanism, which makes it difficult to reuse super_block::s_master_keys). The entries in it ('struct fscrypt_direct_key') do contain a super_block pointer, though, for passing to fscrypt_destroy_inline_crypt_key() when the last inode that references the key is evicted. However, when finding the fscrypt_direct_key for an inode, we weren't actually comparing the super_block pointer. As a result, inodes with different super_blocks could point to the same fscrypt_direct_key. That could extend the lifetime of a fscrypt_direct_key beyond the super_block it points to, causing a use-after-free later. Fix this by creating distinct fscrypt_direct_key structs for distinct super_block structs. Note that this problem doesn't exist in the v2 policy equivalent ("per-mode keys"), since the data structures there are per super_block.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
- git.kernel.org/stable/c/330249609b70778094a7a36f5b6bcfa6362121d4
- git.kernel.org/stable/c/466f187b501a5ac8e1ea2ccf3ccd5c46108d8830
- git.kernel.org/stable/c/95376fe9c145be35566991df99c53134943d992f
- git.kernel.org/stable/c/965b5bc8cf5031225e057979ce660fec2bd5fbfc
- git.kernel.org/stable/c/b5fa40226e71c17847b9ff2816c6ca4133d0d994
- git.kernel.org/stable/c/deff41898a5ae3a47db5fa1896a494aa95efda5d
Recent Use After Free vulnerabilities
- 7.8 High severity
- 9.8 Critical severity
- 7.5 High severity
- 8.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.