CVE-2026-68357

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()

When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to default_gov.

If the governor being unregistered is currently set as default_gov, the default_gov is never cleared. This leads to 2 use-after-free issues:

1. New watchdog devices registered after this point will inherit the dangling default_gov.
2. Existing watchdog devices using the unregistered governor will have their wdd->gov reassigned to the dangling default_gov.

Fix the UAF by clearing default_gov if it matches the governor being unregistered.

Affected product:

AlmaLinux 9.2 ESU , Debian 10 ELS , Debian 11 ELS , TuxCare 9.6 ESU , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS

Affected packages:

linux @ 5.4.0 (+6 more)

Live-patch status from KernelCare for each operating system.