CVE-2026-68179: misc: nsm: only unlock nsm_dev on post-lock error paths
In the Linux kernel, the following vulnerability has been resolved:
misc: nsm: only unlock nsmdev on post-lock error paths
nsmdevioctl() jumps to the common out label even when the initial copyfromuser() fails before nsm->lock has been taken. The error path then blindly unlocks a mutex that was never acquired.
This issue was found by our static analysis tool and then manually reviewed against the current tree.
The grounded PoC kept the miscdevice ioctl entry and the pre-lock copyfromuser(&raw, argp, IOCSIZE(cmd)) failure path by issuing NSMIOCTLRAW with an invalid user pointer. That failure reaches the shared out label before mutexlock(&nsm->lock). Lockdep reported:
WARNING: bad unlock balance detected! exploit/193 is trying to release lock (&globalnsm.lock) at: nsmdevioctl+0x5f/0xcf [vulnmsv] but there are no more locks to release! no locks held by exploit/193.
Return immediately on the pre-lock copyfromuser() failure and keep the common unlock label for the post-lock paths only.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68179?
The severity of CVE-2026-68179 is rated as 5.
How does CVE-2026-68179 affect the Linux kernel?
CVE-2026-68179 affects the Linux kernel by potentially allowing a mutex to be unlocked incorrectly in the nsm_dev_ioctl() function.
What are the implications of exploiting CVE-2026-68179?
Exploiting CVE-2026-68179 could lead to instability or security issues related to the improper handling of mutexes.
How do I fix CVE-2026-68179?
To fix CVE-2026-68179, ensure that you apply the latest patches or updates provided for the Linux kernel.
When was CVE-2026-68179 published?
CVE-2026-68179 was published on August 10, 2026.