CVE-2026-68144
- Source
- https://cve.org/CVERecord?id=CVE-2026-68144
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68144.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-68144
- Downstream
- Published
- 2026-08-10T11:59:08.437Z
- Modified
- 2026-08-15T11:30:57.191087701Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- phonet: pep: fix use-after-free in pep_get_sb()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
phonet: pep: fix use-after-free in pepgetsb()
pepgetsb() doesn't consider that pskbmaypull() might have relocated the skb data, and continue to access the older pointer, causing UAF.
Reproduced under KASAN:
BUG: KASAN: slab-use-after-free in pepgetsb+0x234/0x3b0 Read of size 1 at addr ff11000105510f50 by task repro/157 pepgetsb+0x234/0x3b0 pipehandlerdorcv+0x5f7/0xa10 pepdo_rcv+0x203/0x410 __skreceiveskb+0x471/0x4a0 phonet_rcv+0x5b3/0x6c0 __netifreceiveskb+0xcc/0x1d0
Refetch the header with skbheaderpointer() after pskbmaypull(), so the possibly stale pointer is no longer dereferenced. There are better ways to solve this, but, this is the less instrusive one.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68144.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d
- https://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054
- https://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2
- https://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee
- https://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68144.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-68144
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9641458d3ec42def729fde64669abf07f3220cd5Fixed8d931a75a38b9bb584a4071f5ebbd52755fc35eeFixed17f78c0c0d41d738ee236eb6e841e39395188054Fixeda48a889b60f73edb0399a8b08284a2ab0bd0295fFixed25e3641beb51333bfbb155af2fd2573a61113af2Fixed0f71f852a96af9685858ce59fda34ecbf85c283d