< Back

CVE-2026-68181

Updated on 10 Aug 2026

Severity

7.0 High severity

Details

CVSS score
7.0
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

mei: bus: access mei_device under device_lock on cleanup

Fix couple of problems in mei_cl_bus_dev_release():

mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus.

Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus).

This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too.

Details

Affected product:
AlmaLinux 9.2 ESU , Debian 10 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU
Affected packages:
linux @ 4.19.0 (+3 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 12 Released
13 kernels
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
  • 6.1.164-1
  • 6.1.170-1
  • 6.1.170-3
  • 6.1.172-1
  • 6.1.174-1
  • 6.1.170-2
  • 6.1.176-1
  • 6.1.177-1
  • 6.1.180-1
Debian 13 Released
14 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.74-2
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.69-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
  • 6.12.94-1
  • 6.12.95-1
  • 6.12.96-1
  • 6.12.100-1
Ubuntu 24.04 Planned —
Ubuntu 24.04 AWS Planned —
Ubuntu 26.04 In Rollout
2 kernels
  • 7.0.0-31.31
  • 7.0.0-34.34