CVE-2026-68357: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
In the Linux kernel, the following vulnerability has been resolved:
watchdog: pretimeout: Fix UAF in watchdogunregistergovernor()
When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to defaultgov.
If the governor being unregistered is currently set as defaultgov, the defaultgov is never cleared. This leads to 2 use-after-free issues: 1. New watchdog devices registered after this point will inherit the dangling defaultgov. 2. Existing watchdog devices using the unregistered governor will have their wdd->gov reassigned to the dangling defaultgov.
Fix the UAF by clearing defaultgov if it matches the governor being unregistered.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68357?
CVE-2026-68357 has a risk score of 47, indicating a moderate level of severity.
What is the nature of the vulnerability in CVE-2026-68357?
CVE-2026-68357 is a use-after-free vulnerability in the Linux kernel affecting the watchdog governor.
How do I fix CVE-2026-68357?
To fix CVE-2026-68357, users should update their Linux kernel to the latest patched version.
What systems are affected by CVE-2026-68357?
CVE-2026-68357 affects the Linux kernel that implements watchdog governors.
Is there a workaround for CVE-2026-68357?
There are no known workarounds for CVE-2026-68357 other than applying the appropriate security updates.