CVE-2026-68179 (GCVE-0-2026-68179)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-17 05:00
VLAI
Title
misc: nsm: only unlock nsm_dev on post-lock error paths
Summary
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsm_dev on post-lock error paths nsm_dev_ioctl() jumps to the common out label even when the initial copy_from_user() fails before nsm->lock has been taken. The error path then blindly unlocks a mutex that was never acquired. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the miscdevice ioctl entry and the pre-lock copy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing NSM_IOCTL_RAW with an invalid user pointer. That failure reaches the shared out label before mutex_lock(&nsm->lock). Lockdep reported: WARNING: bad unlock balance detected! exploit/193 is trying to release lock (&global_nsm.lock) at: nsm_dev_ioctl+0x5f/0xcf [vuln_msv] but there are no more locks to release! no locks held by exploit/193. Return immediately on the pre-lock copy_from_user() failure and keep the common unlock label for the post-lock paths only.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b9873755a6c8ccfce79094c4dce9efa3ecb1a749 , < 4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb (git)
Affected: b9873755a6c8ccfce79094c4dce9efa3ecb1a749 , < 8f068342096b027181b168d91fef7ac7a2c64b25 (git)
Affected: b9873755a6c8ccfce79094c4dce9efa3ecb1a749 , < f318f5a872cb9096536e759b23ae5c9873bb80ed (git)
Affected: b9873755a6c8ccfce79094c4dce9efa3ecb1a749 , < ce1fed11d18e163baf7f875152a33bf80f625c1a (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/nsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb",
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "versionType": "git"
            },
            {
              "lessThan": "8f068342096b027181b168d91fef7ac7a2c64b25",
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "versionType": "git"
            },
            {
              "lessThan": "f318f5a872cb9096536e759b23ae5c9873bb80ed",
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "versionType": "git"
            },
            {
              "lessThan": "ce1fed11d18e163baf7f875152a33bf80f625c1a",
              "status": "affected",
              "version": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/nsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: nsm: only unlock nsm_dev on post-lock error paths\n\nnsm_dev_ioctl() jumps to the common out label even when the initial\ncopy_from_user() fails before nsm-\u003elock has been taken.  The error path\nthen blindly unlocks a mutex that was never acquired.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the miscdevice ioctl entry and the pre-lock\ncopy_from_user(\u0026raw, argp, _IOC_SIZE(cmd)) failure path by issuing\nNSM_IOCTL_RAW with an invalid user pointer.  That failure reaches the\nshared out label before mutex_lock(\u0026nsm-\u003elock).  Lockdep reported:\n\n  WARNING: bad unlock balance detected!\n  exploit/193 is trying to release lock (\u0026global_nsm.lock) at:\n  nsm_dev_ioctl+0x5f/0xcf [vuln_msv]\n  but there are no more locks to release!\n  no locks held by exploit/193.\n\nReturn immediately on the pre-lock copy_from_user() failure and keep the\ncommon unlock label for the post-lock paths only."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only via the local ioctl syscall on /dev/nsm (open plus ioctl through vfs_ioctl to nsm_dev_ioctl); it is not exposed through any network protocol or remote service.\nAC:L - An attacker can reliably trigger the pre-lock copy_from_user failure with an invalid userspace pointer and can control the race by issuing concurrent ioctl or /dev/hwrng reads against the same nsm-\u003elock.\nPR:N - The driver registers /dev/nsm as mode 0666 and performs no capability or permission checks in nsm_dev_ioctl, so any local process can open the device and issue NSM_IOCTL_RAW without elevated privileges.\nUI:N - Exploitation requires only the attacker issuing a crafted ioctl with an invalid argument pointer; no victim interaction, mounting, or other user action is needed.\nS:U - Impact is confined to corruption and privilege within the guest Nitro Enclave kernel; it does not cross into the hypervisor, parent instance, or another VM security boundary.\nC:H - Unlocking a mutex not held by the caller can clear owner while another context still holds nsm-\u003elock, permitting concurrent unsynchronized access to shared nsm_msg buffers and virtio response data.\nI:H - Premature mutex release enables overlapping virtqueue operations and corruption of shared kernel message state, a memory-safety defect that can be leveraged for arbitrary kernel integrity compromise.\nA:H - The bug triggers lockdep bad-unlock warnings and kernel oops, and concurrent unsynchronized virtio access can panic, hang, or otherwise deny service to the enclave."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:00:20.666Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f068342096b027181b168d91fef7ac7a2c64b25"
        },
        {
          "url": "https://git.kernel.org/stable/c/f318f5a872cb9096536e759b23ae5c9873bb80ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce1fed11d18e163baf7f875152a33bf80f625c1a"
        }
      ],
      "title": "misc: nsm: only unlock nsm_dev on post-lock error paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68179",
    "datePublished": "2026-08-10T11:59:50.667Z",
    "dateReserved": "2026-07-30T09:28:09.373Z",
    "dateUpdated": "2026-08-17T05:00:20.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68179",
      "date": "2026-08-20",
      "epss": "0.00182",
      "percentile": "0.08142"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68179\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:04.847\",\"lastModified\":\"2026-08-17T05:18:19.590\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmisc: nsm: only unlock nsm_dev on post-lock error paths\\n\\nnsm_dev_ioctl() jumps to the common out label even when the initial\\ncopy_from_user() fails before nsm-\u003elock has been taken.  The error path\\nthen blindly unlocks a mutex that was never acquired.\\n\\nThis issue was found by our static analysis tool and then manually\\nreviewed against the current tree.\\n\\nThe grounded PoC kept the miscdevice ioctl entry and the pre-lock\\ncopy_from_user(\u0026raw, argp, _IOC_SIZE(cmd)) failure path by issuing\\nNSM_IOCTL_RAW with an invalid user pointer.  That failure reaches the\\nshared out label before mutex_lock(\u0026nsm-\u003elock).  Lockdep reported:\\n\\n  WARNING: bad unlock balance detected!\\n  exploit/193 is trying to release lock (\u0026global_nsm.lock) at:\\n  nsm_dev_ioctl+0x5f/0xcf [vuln_msv]\\n  but there are no more locks to release!\\n  no locks held by exploit/193.\\n\\nReturn immediately on the pre-lock copy_from_user() failure and keep the\\ncommon unlock label for the post-lock paths only.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/misc/nsm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b9873755a6c8ccfce79094c4dce9efa3ecb1a749\",\"lessThan\":\"4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9873755a6c8ccfce79094c4dce9efa3ecb1a749\",\"lessThan\":\"8f068342096b027181b168d91fef7ac7a2c64b25\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9873755a6c8ccfce79094c4dce9efa3ecb1a749\",\"lessThan\":\"f318f5a872cb9096536e759b23ae5c9873bb80ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b9873755a6c8ccfce79094c4dce9efa3ecb1a749\",\"lessThan\":\"ce1fed11d18e163baf7f875152a33bf80f625c1a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/misc/nsm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8f068342096b027181b168d91fef7ac7a2c64b25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ce1fed11d18e163baf7f875152a33bf80f625c1a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f318f5a872cb9096536e759b23ae5c9873bb80ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-11T15:33:34+00:00",
      "cve": "CVE-2026-68179",
      "id": "CVE-2026-68179",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: misc: nsm: only unlock nsm_dev on post-lock error paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68179.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-14T23:45:44Z",
      "cve": "CVE-2026-68179",
      "id": "CVE-2026-68179",
      "initial_release_date": "2026-08-13T16:23:30Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68179",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68179.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.