Linux: Multiple Operations on Resource in Single-Operation Context
CVE-2026-68179 is a high-severity multiple operations on resource in single-operation context vulnerability in Linux, with a CVSS 3.1 base score of 8.4 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, without any action from a user. The record lists versions 4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb, 8f068342096b027181b168d91fef7ac7a2c64b25, f318f5a872cb9096536e759b23ae5c9873bb80ed as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb or 8f068342096b027181b168d91fef7ac7a2c64b25 or f318f5a872cb9096536e759b23ae5c9873bb80ed or ce1fed11d18e163baf7f875152a33bf80f625c1a, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | b9873755a6c8ccfce79094c4dce9efa3ecb1a749 up to, but not including, 4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb; b9873755a6c8ccfce79094c4dce9efa3ecb1a749 up to, but not including, 8f068342096b027181b168d91fef7ac7a2c64b25; b9873755a6c8ccfce79094c4dce9efa3ecb1a749 up to, but not including, f318f5a872cb9096536e759b23ae5c9873bb80ed; b9873755a6c8ccfce79094c4dce9efa3ecb1a749 up to, but not including, ce1fed11d18e163baf7f875152a33bf80f625c1a; 6.8 | 4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb, 8f068342096b027181b168d91fef7ac7a2c64b25, f318f5a872cb9096536e759b23ae5c9873bb80ed, ce1fed11d18e163baf7f875152a33bf80f625c1a |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsm_dev on post-lock error paths nsm_dev_ioctl() jumps to the common out label even when the initial copy_from_user() fails before nsm->lock has been taken. The error path then blindly unlocks a mutex that was never acquired. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the miscdevice ioctl entry and the pre-lock copy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing NSM_IOCTL_RAW with an invalid user pointer. That failure reaches the shared out label before mutex_lock(&nsm->lock). Lockdep reported: WARNING: bad unlock balance detected! exploit/193 is trying to release lock (&global_nsm.lock) at: nsm_dev_ioctl+0x5f/0xcf [vuln_msv] but there are no more locks to release! no locks held by exploit/193. Return immediately on the pre-lock copy_from_user() failure and keep the common unlock label for the post-lock paths only.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Multiple Operations on Resource in Single-Operation Context
The product performs the same operation on a resource two or more times, when the operation should only be applied once.
More Multiple Operations on Resource in Single-Operation Context vulnerabilities (CWE-675)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
Spotted an error? Tell us.