CyberSecBulletin
CVE-2026-68354NVD status: Received

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-68354 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 1aaf16031d65ccd4576451a79f7dabbec994c111, 0a219b2a01b4fe93706717e3bcacf7f62967b26f, 268cea3800eda5fa3ee04a49ee2973b8766a8df3 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.28% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 1aaf16031d65ccd4576451a79f7dabbec994c111 or 0a219b2a01b4fe93706717e3bcacf7f62967b26f or 268cea3800eda5fa3ee04a49ee2973b8766a8df3 or b7d633c7c92321be98724b1d365e8ce507f2f349, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxc76acec6d55107b652a37c90b36c00bc8b04dabb up to, but not including, 1aaf16031d65ccd4576451a79f7dabbec994c111; c76acec6d55107b652a37c90b36c00bc8b04dabb up to, but not including, 0a219b2a01b4fe93706717e3bcacf7f62967b26f; c76acec6d55107b652a37c90b36c00bc8b04dabb up to, but not including, 268cea3800eda5fa3ee04a49ee2973b8766a8df3; c76acec6d55107b652a37c90b36c00bc8b04dabb up to, but not including, b7d633c7c92321be98724b1d365e8ce507f2f349; c76acec6d55107b652a37c90b36c00bc8b04dabb up to, but not including, 22e05b8ddbcf7d22c7f1598786e86635547e554d; c76acec6d55107b652a37c90b36c00bc8b04dabb up to, but not including, 0177e578d7a885037b0fb82286c12e9d0360cc10; c76acec6d55107b652a37c90b36c00bc8b04dabb up to, but not including, 2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999; c76acec6d55107b652a37c90b36c00bc8b04dabb up to, but not including, d52a13adbb8ccbab99cd3bad36804e87d8b5c052; and 1 more ranges1aaf16031d65ccd4576451a79f7dabbec994c111, 0a219b2a01b4fe93706717e3bcacf7f62967b26f, 268cea3800eda5fa3ee04a49ee2973b8766a8df3, b7d633c7c92321be98724b1d365e8ce507f2f349, 22e05b8ddbcf7d22c7f1598786e86635547e554d, 0177e578d7a885037b0fb82286c12e9d0360cc10

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment also closes the gap to the next or previous list entry. Those neighbor lookups currently assume that the current fragment always has a real next or previous fragment. At a list edge, the next or previous entry is the list head, not a struct fwnet_fragment_info. The gap checks also compare against the old edge of the current fragment instead of the edge after adding the new fragment. As a result, a fragment that bridges two existing ranges may leave two adjacent ranges unmerged, so fwnet_pd_is_complete() can miss a complete datagram. Check for the list head before looking up the neighboring fragment, and compare the neighbor against the new fragment's far edge when deciding whether to merge all three ranges. This issue was found by a static analysis checker and confirmed by manual source review.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.