---
id: CVE-2026-68178
title: 'misc: nsm: pin the module while the device is open'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  misc: nsm: pin the module while the device is open

  misc_open() installs a misc driver's file operations with fops_get(),
  which pins file_operations::owner before repla…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 <
    1996639f824ce9468395cdb7bcb8f467fa787e77
  - >-
    Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 <
    1da310b94504d42001e9c32c43c5dc105b777e5f
  - >-
    Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 <
    9e9a82d00c3d10129fc310a7547b24a679d5d920
  - >-
    Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 <
    3b231f1e9990f4c21220d0a69733ce2105891ff9
  - Linux 6.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:45:28.962889Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:02.163Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68178'
references:
  - url: 'https://git.kernel.org/stable/c/1996639f824ce9468395cdb7bcb8f467fa787e77'
  - url: 'https://git.kernel.org/stable/c/1da310b94504d42001e9c32c43c5dc105b777e5f'
  - url: 'https://git.kernel.org/stable/c/9e9a82d00c3d10129fc310a7547b24a679d5d920'
  - url: 'https://git.kernel.org/stable/c/3b231f1e9990f4c21220d0a69733ce2105891ff9'
tags:
  - cve.org
epss: 0.00163
epssPercentile: 0.05186
ingestedAt: '2026-10-16T17:24:46.848Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

misc: nsm: pin the module while the device is open

misc_open() installs a misc driver's file operations with fops_get(),
which pins file_operations::owner before replacing the file's f_op.  The
NSM misc device leaves nsm_dev_fops.owner unset, so opening /dev/nsm does
not take a module reference on the nsm driver.

If the driver is built as a module, an open file descriptor can therefore
survive rmmod of the module that provides its ioctl callbacks.  A later
ioctl through that descriptor can call into unloaded module text.

Set nsm_dev_fops.owner to THIS_MODULE so the misc core holds the module
while any /dev/nsm file descriptor is open, matching the lifetime
expectation for the installed file operations.

## Affected

- `Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < 1996639f824ce9468395cdb7bcb8f467fa787e77`
- `Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < 1da310b94504d42001e9c32c43c5dc105b777e5f`
- `Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < 9e9a82d00c3d10129fc310a7547b24a679d5d920`
- `Linux >= b9873755a6c8ccfce79094c4dce9efa3ecb1a749 < 3b231f1e9990f4c21220d0a69733ce2105891ff9`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.