CVE-2026-68144

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-68144

Key Details

CVE	CVE-2026-68144
CVSS Score / Version	9.8 (Critical) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

phonet: pep: fix use-after-free in pep_get_sb()

pep_get_sb() doesn't consider that pskb_may_pull() might have relocated

the skb data, and continue to access the older pointer, causing UAF.

Reproduced under KASAN:

BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0

Read of size 1 at addr ff11000105510f50 by task repro/157

pep_get_sb+0x234/0x3b0

pipe_handler_do_rcv+0x5f7/0xa10

pep_do_rcv+0x203/0x410

__sk_receive_skb+0x471/0x4a0

phonet_rcv+0x5b3/0x6c0

__netif_receive_skb+0xcc/0x1d0

Refetch the header with skb_header_pointer() after pskb_may_pull(), so

the possibly stale pointer is no longer dereferenced. There are better

ways to solve this, but, this is the less instrusive one. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-68144
CVE	https://www.cve.org/CVERecord?id=CVE-2026-68144

Source

Reference

NVD

CVE