CyberSecBulletin
CVE-2026-68161NVD status: Received

Linux: Improper Resource Shutdown or Release

Published Updated By the CyberSecBulletin desk

CVE-2026-68161 is a critical-severity improper resource shutdown or release vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions c29affd44e6769e3073235d4b471d9b501fa8166, c6eb2d615210b80339548ab07c0230edaab9a6c7, 8ff78591d309c50a4fdab683b68dd8d512a270dd as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.68% chance of exploitation within 30 days, higher than 53% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to c29affd44e6769e3073235d4b471d9b501fa8166 or c6eb2d615210b80339548ab07c0230edaab9a6c7 or 8ff78591d309c50a4fdab683b68dd8d512a270dd or 3bf0e349cbb4f975f35eb22753acc346b89c66a0, whichever matches your release line, or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux046c052b475e7119b6a30e3483e2888fc606a2f8 up to, but not including, c29affd44e6769e3073235d4b471d9b501fa8166; 046c052b475e7119b6a30e3483e2888fc606a2f8 up to, but not including, c6eb2d615210b80339548ab07c0230edaab9a6c7; 046c052b475e7119b6a30e3483e2888fc606a2f8 up to, but not including, 8ff78591d309c50a4fdab683b68dd8d512a270dd; 046c052b475e7119b6a30e3483e2888fc606a2f8 up to, but not including, 3bf0e349cbb4f975f35eb22753acc346b89c66a0; 046c052b475e7119b6a30e3483e2888fc606a2f8 up to, but not including, 37ff9794be48d0caa37687e04d09675f9c849121; 046c052b475e7119b6a30e3483e2888fc606a2f8 up to, but not including, ffb2bd7ade36ec4da32c46a6eddbf4515316d08c; 5.11c29affd44e6769e3073235d4b471d9b501fa8166, c6eb2d615210b80339548ab07c0230edaab9a6c7, 8ff78591d309c50a4fdab683b68dd8d512a270dd, 3bf0e349cbb4f975f35eb22753acc346b89c66a0, 37ff9794be48d0caa37687e04d09675f9c849121, ffb2bd7ade36ec4da32c46a6eddbf4515316d08c

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when net.sctp.udp_port is set, and stops/restarts them when the sysctl value changes. The netns exit path does not stop these sockets, so a namespace can be torn down while its SCTP UDP tunnel sockets are still installed. Close the UDP tunnel sockets from sctp_ctrlsock_exit() after unregistering the per-net sysctl table. This prevents new sysctl writes from racing in while the sockets are being released, and closes the sockets before the control socket is destroyed.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
  • It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
  • Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].

More Improper Resource Shutdown or Release vulnerabilities (CWE-404)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Resource Shutdown or Release vulnerabilities

Spotted an error? Tell us.