UBUNTU-CVE-2026-68458: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction() bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The subtraction reads lsmctx.len, but that field has already been cleared by the time the line runs: securitysecidtosecctx(secid, &lsmctx) / lsmctx.len set / lsmctxalignedsize = ALIGN(lsmctx.len, sizeof(u64)) extrabufferssize += lsmctxalignedsize ... securityreleasesecctx(&lsmctx) / memset zeroes len / ... sgbufendoffset = sgbufoffset + extrabufferssize - ALIGN(lsmctx.len, sizeof(u64)) / ALIGN(0,8) / securityreleasesecctx() does memset(cp, 0, sizeof(cp)), so lsmctx.len reads back as 0 and the subtraction contributes nothing, leaving sgbufendoffset too large by the aligned secctx size on every transaction to a txnsecurityctx node. Each BINDERTYPEPTR object then derives bufleft = sgbufendoffset - sgbufoffset as the sole upper bound on its copy, so the inflated end offset lets the copy run into the bytes that already hold the secctx. The aligned size must therefore be cached before release rather than re-read from the now-cleared field. Fix by caching it in lsmctxalignedsize at function scope when it is first computed and subtracting lsmctxalignedsize instead of re-reading lsmctx.len after release. Reuse the same value for the earlier bufoffset computation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
The affected Ubuntu kernel package variants listed are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. The flawed path is exercised by transactions to a binder node using a transaction security context.
What access does an attacker need?
The vector is local and requires low privileges. No user interaction is required.
What is the impact of successful exploitation?
The oversized scatter-gather buffer bound can allow a BINDER_TYPE_PTR copy to overwrite bytes holding the LSM security context. The provided severity vector indicates integrity impact is limited, with no stated confidentiality or availability impact.
How can I determine whether a system is affected?
Check whether the system is running one of the listed Ubuntu kernel package variants and whether it includes the fix for CVE-2026-68458. The issue is specifically relevant to binder transactions involving a txn_security_ctx node.