CyberSecBulletin
CVE-2026-68388NVD status: Received

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-68388 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions aeb58a4eb39a7ff4d7782b4f4ada0fda5e0675d2, 01719883235507b1585e4c51e320d9a7113dc698, f47c7277c03a636fcc3a57969f2dc09567b3c050 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.51% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to aeb58a4eb39a7ff4d7782b4f4ada0fda5e0675d2 or 01719883235507b1585e4c51e320d9a7113dc698 or f47c7277c03a636fcc3a57969f2dc09567b3c050 or 437637f5ff3f573b2edf8571de91fb00a21eb4e6, whichever matches your release line, or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxc406bb9ece6ef63721daab106f132ff4b4234e81 up to, but not including, aeb58a4eb39a7ff4d7782b4f4ada0fda5e0675d2; 966a3cb7c7db786452a87afdc3b48858fc4d4d6b up to, but not including, 01719883235507b1585e4c51e320d9a7113dc698; 966a3cb7c7db786452a87afdc3b48858fc4d4d6b up to, but not including, f47c7277c03a636fcc3a57969f2dc09567b3c050; 966a3cb7c7db786452a87afdc3b48858fc4d4d6b up to, but not including, 437637f5ff3f573b2edf8571de91fb00a21eb4e6; 966a3cb7c7db786452a87afdc3b48858fc4d4d6b up to, but not including, 377fe3e583e46369ee1004d5cfe12271d6589a68; 966a3cb7c7db786452a87afdc3b48858fc4d4d6b up to, but not including, 7e08ab7a061b17ac1989a225c6afb53f44a86808; 966a3cb7c7db786452a87afdc3b48858fc4d4d6b up to, but not including, a4a09e5142835633fffbde68bd0a039ba4d4bf97; 966a3cb7c7db786452a87afdc3b48858fc4d4d6b up to, but not including, b09ae45d85dc816987a71db9eebc54b0ae288e94; and 6 more rangesaeb58a4eb39a7ff4d7782b4f4ada0fda5e0675d2, 01719883235507b1585e4c51e320d9a7113dc698, f47c7277c03a636fcc3a57969f2dc09567b3c050, 437637f5ff3f573b2edf8571de91fb00a21eb4e6, 377fe3e583e46369ee1004d5cfe12271d6589a68, 7e08ab7a061b17ac1989a225c6afb53f44a86808

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled, but fallocate still returns success. A later write to that hole may therefore fail with ENOSPC. The function queries allocated ranges so that it can preserve existing contents and write zeroes only into holes. However, the server may return a range that starts before the current fallocate offset. For example, assume the fallocate request is [100, 400) and the only allocated range returned by the server is [0, 200): Request: [100, 400) Server range: [ 0, 200) allocated Correct: [100, 200) allocated data, skip [200, 400) hole, zero-fill Current: [100, 300) skipped [300, 400) zero-filled afterwards The current code adds the full server range length, 200, to the current offset 100 and moves to 300. As a result, the hole in [200, 300) is skipped without being zero-filled. Fix this by advancing only over the part of the allocated range that overlaps the current fallocate offset. Ignore ranges that end before the current offset and reject ranges whose end offset overflows. This also prevents a malformed range length from causing an out-of-bounds zero-buffer read.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.