GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68137 (GCVE-0-2026-68137)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-19 16:29
VLAI
Title
net/x25: fix use-after-free in x25_kill_by_neigh()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25_kill_by_neigh() x25_kill_by_neigh() walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25_list_lock protects list membership while the lookup is in progress, but it does not pin a socket's lifetime after the lock is dropped. The function currently drops x25_list_lock before calling lock_sock(s). A concurrent close can run x25_release(), remove the same socket from x25_list, and drop the last socket reference in that window. The neighbour teardown path can then lock or inspect a freed struct sock/struct x25_sock. Take sock_hold(s) while x25_list_lock still proves that the list entry is live, then drop the temporary reference after the socket has been locked, rechecked, and released. Recheck x25_sk(s)->neighbour after lock_sock(), because another path may have disconnected the socket before this path acquired the socket lock. Restart the list walk after each disconnect because the list lock was dropped and the previous iterator state may no longer be valid. A QEMU/KASAN run against origin/master reproduced a slab-use-after-free in x25_kill_by_neigh().
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5c94b6205e87411dbe9dc1ca088eb36b8837fb47 , < db6b04f6d65549bb1c7bc8e64a92e7b7d03be676 (git)
Affected: 409570a619c1cda2e0fde6018a256b9e3d3ba0ee , < 5e8a754ac2009a88a7b99ab61eab6296eed360f3 (git)
Affected: 7781607938c8371d4c2b243527430241c62e39c2 , < c98a454d1a9e1bd09d5fd55a7aa589b199340b88 (git)
Affected: 7781607938c8371d4c2b243527430241c62e39c2 , < 3f4fe26c20c30bd5a2e2583e80685def0b27858c (git)
Affected: 7781607938c8371d4c2b243527430241c62e39c2 , < 610678d4be94b619c751572e8a58de705592cd07 (git)
Affected: 7781607938c8371d4c2b243527430241c62e39c2 , < ec6d91a1bf2ebd767d3d43f6d249ee0ed3f4558a (git)
Affected: 7781607938c8371d4c2b243527430241c62e39c2 , < 9aabda553184346f74810e2ee1d96920b4612e3f (git)
Affected: 7781607938c8371d4c2b243527430241c62e39c2 , < 5499e0602d2faafd42c580d25f615903c3fbe11b (git)
Affected: dffc859d1d9560da594e4282091781b8d2715f00 (git)
Affected: 858642789ada1b48630f322e59416ca9fca3e6b7 (git)
Affected: 4c240c5a105557e4546d0836e694868f22fd09b0 (git)
Affected: 9acf05b4e7b55fdb712ef7b331dbce5bcd391d0f (git)
Affected: 4a279d7ee1c65411b4055ecd428b8aa2b1711c1f (git)
Affected: 671529db75e6be777bb1c76aa07c2bdd2992be6d (git)
Affected: 5.10.110 , < 5.10.265 (semver)
Affected: 5.15.33 , < 5.15.216 (semver)
Affected: 4.9.311 , < 4.10 (semver)
Affected: 4.14.276 , < 4.15 (semver)
Affected: 4.19.238 , < 4.20 (semver)
Affected: 5.4.189 , < 5.5 (semver)
Affected: 5.16.19 , < 5.17 (semver)
Affected: 5.17.2 , < 5.18 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/x25/af_x25.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "db6b04f6d65549bb1c7bc8e64a92e7b7d03be676",
              "status": "affected",
              "version": "5c94b6205e87411dbe9dc1ca088eb36b8837fb47",
              "versionType": "git"
            },
            {
              "lessThan": "5e8a754ac2009a88a7b99ab61eab6296eed360f3",
              "status": "affected",
              "version": "409570a619c1cda2e0fde6018a256b9e3d3ba0ee",
              "versionType": "git"
            },
            {
              "lessThan": "c98a454d1a9e1bd09d5fd55a7aa589b199340b88",
              "status": "affected",
              "version": "7781607938c8371d4c2b243527430241c62e39c2",
              "versionType": "git"
            },
            {
              "lessThan": "3f4fe26c20c30bd5a2e2583e80685def0b27858c",
              "status": "affected",
              "version": "7781607938c8371d4c2b243527430241c62e39c2",
              "versionType": "git"
            },
            {
              "lessThan": "610678d4be94b619c751572e8a58de705592cd07",
              "status": "affected",
              "version": "7781607938c8371d4c2b243527430241c62e39c2",
              "versionType": "git"
            },
            {
              "lessThan": "ec6d91a1bf2ebd767d3d43f6d249ee0ed3f4558a",
              "status": "affected",
              "version": "7781607938c8371d4c2b243527430241c62e39c2",
              "versionType": "git"
            },
            {
              "lessThan": "9aabda553184346f74810e2ee1d96920b4612e3f",
              "status": "affected",
              "version": "7781607938c8371d4c2b243527430241c62e39c2",
              "versionType": "git"
            },
            {
              "lessThan": "5499e0602d2faafd42c580d25f615903c3fbe11b",
              "status": "affected",
              "version": "7781607938c8371d4c2b243527430241c62e39c2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dffc859d1d9560da594e4282091781b8d2715f00",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "858642789ada1b48630f322e59416ca9fca3e6b7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4c240c5a105557e4546d0836e694868f22fd09b0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9acf05b4e7b55fdb712ef7b331dbce5bcd391d0f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a279d7ee1c65411b4055ecd428b8aa2b1711c1f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "671529db75e6be777bb1c76aa07c2bdd2992be6d",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.265",
              "status": "affected",
              "version": "5.10.110",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.216",
              "status": "affected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.311",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/x25/af_x25.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10.110",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.15.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.311",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.276",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.238",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.189",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: fix use-after-free in x25_kill_by_neigh()\n\nx25_kill_by_neigh() walks the global X.25 socket list looking for sockets\nattached to a terminating neighbour. x25_list_lock protects list membership\nwhile the lookup is in progress, but it does not pin a socket\u0027s lifetime\nafter the lock is dropped.\n\nThe function currently drops x25_list_lock before calling lock_sock(s). A\nconcurrent close can run x25_release(), remove the same socket from\nx25_list, and drop the last socket reference in that window. The neighbour\nteardown path can then lock or inspect a freed struct sock/struct x25_sock.\n\nTake sock_hold(s) while x25_list_lock still proves that the list entry is\nlive, then drop the temporary reference after the socket has been locked,\nrechecked, and released. Recheck x25_sk(s)-\u003eneighbour after lock_sock(),\nbecause another path may have disconnected the socket before this path\nacquired the socket lock. Restart the list walk after each disconnect\nbecause the list lock was dropped and the previous iterator state may no\nlonger be valid.\n\nA QEMU/KASAN run against origin/master reproduced a slab-use-after-free in\nx25_kill_by_neigh()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - x25_kill_by_neigh() is invoked from the net stack when inbound X.25 link-control frames (RESTART_REQUEST/CONFIRMATION with LCI 0, or IFACE_DISCONNECT) are processed on ARPHRD_X25 interfaces via the ETH_P_X25 packet handler, the normal WAN-facing path in telecom/banking/industrial X.25 deployments.\nAC:L - This is a use-after-free race between neighbour teardown and socket close(); an attacker controls both sides by racing close() on an AF_X25 socket against RESTART/terminate frames they send, and KASAN reproduced the slab-UAF under controlled testing.\nPR:N - A remote X.25 peer on the WAN needs no Linux credentials to deliver RESTART/terminate frames that reach x25_kill_by_neigh(); exploitation races that path against any local X.25 consumer closing sockets, without the attacker holding privileges on the victim host.\nUI:N - No victim user interaction is required beyond normal automated X.25 service operation (accepting calls, reconnecting, or closing sessions) that can be timed against remotely injected link-control frames.\nS:U - The vulnerability corrupts kernel heap memory within the host kernel security boundary; it does not cross VM, container, or IOMMU isolation boundaries.\nC:H - Use-after-free on struct sock/x25_sock lets an attacker influence reuse of freed slab objects, enabling arbitrary kernel memory disclosure per CNA guidance for kernel UAF bugs.\nI:H - Use-after-free on socket structures can be leveraged through heap shaping into arbitrary kernel writes, privilege escalation, or code execution per CNA guidance for kernel UAF bugs.\nA:H - The bug is a confirmed slab use-after-free in kernel context (KASAN-reproduced) that can oops or panic the kernel during lock_sock()/x25_disconnect() even before full exploit development."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:54.672Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/db6b04f6d65549bb1c7bc8e64a92e7b7d03be676"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e8a754ac2009a88a7b99ab61eab6296eed360f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c98a454d1a9e1bd09d5fd55a7aa589b199340b88"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f4fe26c20c30bd5a2e2583e80685def0b27858c"
        },
        {
          "url": "https://git.kernel.org/stable/c/610678d4be94b619c751572e8a58de705592cd07"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec6d91a1bf2ebd767d3d43f6d249ee0ed3f4558a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9aabda553184346f74810e2ee1d96920b4612e3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5499e0602d2faafd42c580d25f615903c3fbe11b"
        }
      ],
      "title": "net/x25: fix use-after-free in x25_kill_by_neigh()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68137",
    "datePublished": "2026-08-10T11:59:00.740Z",
    "dateReserved": "2026-07-30T09:28:09.370Z",
    "dateUpdated": "2026-08-19T16:29:54.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68137",
      "date": "2026-09-17",
      "epss": "0.00536",
      "percentile": "0.43964"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68137\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:19:59.253\",\"lastModified\":\"2026-08-19T17:20:30.880\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/x25: fix use-after-free in x25_kill_by_neigh()\\n\\nx25_kill_by_neigh() walks the global X.25 socket list looking for sockets\\nattached to a terminating neighbour. x25_list_lock protects list membership\\nwhile the lookup is in progress, but it does not pin a socket\u0027s lifetime\\nafter the lock is dropped.\\n\\nThe function currently drops x25_list_lock before calling lock_sock(s). A\\nconcurrent close can run x25_release(), remove the same socket from\\nx25_list, and drop the last socket reference in that window. The neighbour\\nteardown path can then lock or inspect a freed struct sock/struct x25_sock.\\n\\nTake sock_hold(s) while x25_list_lock still proves that the list entry is\\nlive, then drop the temporary reference after the socket has been locked,\\nrechecked, and released. Recheck x25_sk(s)-\u003eneighbour after lock_sock(),\\nbecause another path may have disconnected the socket before this path\\nacquired the socket lock. Restart the list walk after each disconnect\\nbecause the list lock was dropped and the previous iterator state may no\\nlonger be valid.\\n\\nA QEMU/KASAN run against origin/master reproduced a slab-use-after-free in\\nx25_kill_by_neigh().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/x25/af_x25.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5c94b6205e87411dbe9dc1ca088eb36b8837fb47\",\"lessThan\":\"db6b04f6d65549bb1c7bc8e64a92e7b7d03be676\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"409570a619c1cda2e0fde6018a256b9e3d3ba0ee\",\"lessThan\":\"5e8a754ac2009a88a7b99ab61eab6296eed360f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7781607938c8371d4c2b243527430241c62e39c2\",\"lessThan\":\"c98a454d1a9e1bd09d5fd55a7aa589b199340b88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7781607938c8371d4c2b243527430241c62e39c2\",\"lessThan\":\"3f4fe26c20c30bd5a2e2583e80685def0b27858c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7781607938c8371d4c2b243527430241c62e39c2\",\"lessThan\":\"610678d4be94b619c751572e8a58de705592cd07\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7781607938c8371d4c2b243527430241c62e39c2\",\"lessThan\":\"ec6d91a1bf2ebd767d3d43f6d249ee0ed3f4558a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7781607938c8371d4c2b243527430241c62e39c2\",\"lessThan\":\"9aabda553184346f74810e2ee1d96920b4612e3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7781607938c8371d4c2b243527430241c62e39c2\",\"lessThan\":\"5499e0602d2faafd42c580d25f615903c3fbe11b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dffc859d1d9560da594e4282091781b8d2715f00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"858642789ada1b48630f322e59416ca9fca3e6b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c240c5a105557e4546d0836e694868f22fd09b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9acf05b4e7b55fdb712ef7b331dbce5bcd391d0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a279d7ee1c65411b4055ecd428b8aa2b1711c1f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"671529db75e6be777bb1c76aa07c2bdd2992be6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.110\",\"lessThan\":\"5.10.265\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.33\",\"lessThan\":\"5.15.216\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.311\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.276\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.238\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.189\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.16.19\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.17.2\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/x25/af_x25.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3f4fe26c20c30bd5a2e2583e80685def0b27858c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5499e0602d2faafd42c580d25f615903c3fbe11b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e8a754ac2009a88a7b99ab61eab6296eed360f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/610678d4be94b619c751572e8a58de705592cd07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9aabda553184346f74810e2ee1d96920b4612e3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c98a454d1a9e1bd09d5fd55a7aa589b199340b88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db6b04f6d65549bb1c7bc8e64a92e7b7d03be676\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec6d91a1bf2ebd767d3d43f6d249ee0ed3f4558a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:17:05+00:00",
      "cve": "CVE-2026-68137",
      "id": "CVE-2026-68137",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/x25: fix use-after-free in x25_kill_by_neigh()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68137.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T17:12:05Z",
      "cve": "CVE-2026-68137",
      "id": "CVE-2026-68137",
      "initial_release_date": "2026-08-18T16:56:19Z",
      "product_status:first_fixed": "65",
      "product_status:known_affected": "671",
      "product_status:known_not_affected": "93",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68137",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68137.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.