GHSA-XMJ6-8MRG-F8FX

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-10 15:33
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

mei: bus: access mei_device under device_lock on cleanup

Fix couple of problems in mei_cl_bus_dev_release():

mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus.

Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus).

This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-68181"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:05Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmei: bus: access mei_device under device_lock on cleanup\n\nFix couple of problems in mei_cl_bus_dev_release():\n\nmei_cl_flush_queues() is running without lock.\nbus-\u003efile_list access after mei_dev_bus_put(bus) can become a\nuse-after-free if this was the last reference to bus.\n\nProtect queues cleanup and WARN traversal by device lock there\nto avoid the concurrent access problems.\nMove WARN traversal before mei_dev_bus_put(bus).\n\nThis file uses bus variable name for mei_device, adjust\ncode of mei_cl_bus_dev_release() to use bus variable too.",
  "id": "GHSA-xmj6-8mrg-f8fx",
  "modified": "2026-08-10T15:33:39Z",
  "published": "2026-08-10T15:33:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68181"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/441559d4c595f839b39f0ab6a4ae628427c2fd9e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/59dd34854202d9a3faaa87a85205e553fe7150e1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7cf79e8d682fe93777268f029668ce5e214237fd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c88c030a324c9018b77894a19b2564eb66862020"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f112ea910e554d58b4b39a4492b7d302f0f4204f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.