{"id":"CVE-2026-68179","title":"misc: nsm: only unlock nsm_dev on post-lock error paths","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: nsm: only unlock nsm_dev on post-lock error paths\n\nnsm_dev_ioctl() jumps to the common out label even when the initial\ncopy_from_user() fails before nsm->lock has…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < 4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb","Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < 8f068342096b027181b168d91fef7ac7a2c64b25","Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < f318f5a872cb9096536e759b23ae5c9873bb80ed","Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < ce1fed11d18e163baf7f875152a33bf80f625c1a","Linux 6.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:45:31.753016Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:02.338Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68179","references":[{"url":"https://git.kernel.org/stable/c/4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb"},{"url":"https://git.kernel.org/stable/c/8f068342096b027181b168d91fef7ac7a2c64b25"},{"url":"https://git.kernel.org/stable/c/f318f5a872cb9096536e759b23ae5c9873bb80ed"},{"url":"https://git.kernel.org/stable/c/ce1fed11d18e163baf7f875152a33bf80f625c1a"}],"tags":["cve.org"],"epss":0.0018,"epssPercentile":0.07094,"ingestedAt":"2026-10-16T17:24:46.847Z","slug":"CVE-2026-68179","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmisc: nsm: only unlock nsm_dev on post-lock error paths\n\nnsm_dev_ioctl() jumps to the common out label even when the initial\ncopy_from_user() fails before nsm->lock has been taken.  The error path\nthen blindly unlocks a mutex that was never acquired.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the miscdevice ioctl entry and the pre-lock\ncopy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing\nNSM_IOCTL_RAW with an invalid user pointer.  That failure reaches the\nshared out label before mutex_lock(&nsm->lock).  Lockdep reported:\n\n  WARNING: bad unlock balance detected!\n  exploit/193 is trying to release lock (&global_nsm.lock) at:\n  nsm_dev_ioctl+0x5f/0xcf [vuln_msv]\n  but there are no more locks to release!\n  no locks held by exploit/193.\n\nReturn immediately on the pre-lock copy_from_user() failure and keep the\ncommon unlock label for the post-lock paths only.\n\n## Affected\n\n- `Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < 4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb`\n- `Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < 8f068342096b027181b168d91fef7ac7a2c64b25`\n- `Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < f318f5a872cb9096536e759b23ae5c9873bb80ed`\n- `Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < ce1fed11d18e163baf7f875152a33bf80f625c1a`\n- `Linux 6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}