CVE-2026-68144: phonet: pep: fix use-after-free in pep_get_sb()
In the Linux kernel, the following vulnerability has been resolved:
phonet: pep: fix use-after-free in pepgetsb()
pepgetsb() doesn't consider that pskbmaypull() might have relocated the skb data, and continue to access the older pointer, causing UAF.
Reproduced under KASAN:
BUG: KASAN: slab-use-after-free in pepgetsb+0x234/0x3b0 Read of size 1 at addr ff11000105510f50 by task repro/157 pepgetsb+0x234/0x3b0 pipehandlerdorcv+0x5f7/0xa10 pepdorcv+0x203/0x410 skreceiveskb+0x471/0x4a0 phonetrcv+0x5b3/0x6c0 netifreceiveskb+0xcc/0x1d0
Refetch the header with skbheaderpointer() after pskbmaypull(), so the possibly stale pointer is no longer dereferenced. There are better ways to solve this, but, this is the less instrusive one.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68144?
The severity of CVE-2026-68144 is rated at 47.
How do I fix CVE-2026-68144?
To fix CVE-2026-68144, ensure that you update to the latest version of the Linux kernel that includes the patch for the use-after-free issue.
What kind of vulnerability is CVE-2026-68144?
CVE-2026-68144 is classified as a use-after-free vulnerability.
What component is affected by CVE-2026-68144?
CVE-2026-68144 affects the phonet networking component in the Linux kernel.
What can be the impact of CVE-2026-68144?
The impact of CVE-2026-68144 can lead to undefined behavior and potential security risks due to memory access after free.