Linux: Use After Free
CVE-2026-68427 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 86a9bd8c8f422d5f3079da31e151868902fcc702, abeff53233b984571b87582bb588b4b38ef4ea50, 5b7e5f84d3d4cea10c3764d2da274810a7934228 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 86a9bd8c8f422d5f3079da31e151868902fcc702 or abeff53233b984571b87582bb588b4b38ef4ea50 or 5b7e5f84d3d4cea10c3764d2da274810a7934228 or 5f4de3c717d34a24d555af581947742980778c02, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | af755456299d44e4ed6af3b7c70a7f03ea37fdf1 up to, but not including, 86a9bd8c8f422d5f3079da31e151868902fcc702; 71c017b3f83ff72638f2a1b1d6d4e7bc61d30231 up to, but not including, abeff53233b984571b87582bb588b4b38ef4ea50; 0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602 up to, but not including, 5b7e5f84d3d4cea10c3764d2da274810a7934228; 8c0d3cf0d5108c96317e0eca92b60dd368867cef up to, but not including, 5f4de3c717d34a24d555af581947742980778c02; df63c76f9c8d881ca7bce1aecfba512328d0527d up to, but not including, b773faa32b0a98c3eb2b50d96de631681e5d1157; 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc up to, but not including, 266cddf7bd0f6c79b6c0633aef742a22bf70265b; 6.1.178 up to, but not including, 6.1.183; 6.6.145 up to, but not including, 6.6.148; and 3 more ranges | 86a9bd8c8f422d5f3079da31e151868902fcc702, abeff53233b984571b87582bb588b4b38ef4ea50, 5b7e5f84d3d4cea10c3764d2da274810a7934228, 5f4de3c717d34a24d555af581947742980778c02, b773faa32b0a98c3eb2b50d96de631681e5d1157, 266cddf7bd0f6c79b6c0633aef742a22bf70265b |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
- git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b
- git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228
- git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02
- git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702
- git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50
- git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157
Recent Use After Free vulnerabilities
- 9.8 Critical severity
- 7.5 High severity
- 8.8 High severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
Spotted an error? Tell us.