{"id":"CVE-2026-68179","revision":"c33780900aff4881ac58a8e41f78af95","records":[{"revision":"c33780900aff4881ac58a8e41f78af95","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68179","aliases":[],"title":"misc: nsm: only unlock nsm_dev on post-lock error paths","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: nsm: only unlock nsm_dev on post-lock error paths\n\nnsm_dev_ioctl() jumps to the common out label even when the initial\ncopy_from_user() fails before nsm->lock has been taken.  The error path\nthen blindly unlocks a mutex that was never acquired.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the miscdevice ioctl entry and the pre-lock\ncopy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing\nNSM_IOCTL_RAW with an invalid user pointer.  That failure reaches the\nshared out label before mutex_lock(&nsm->lock).  Lockdep reported:\n\n  WARNING: bad unlock balance detected!\n  exploit/193 is trying to release lock (&global_nsm.lock) at:\n  nsm_dev_ioctl+0x5f/0xcf [vuln_msv]\n  but there are no more locks to release!\n  no locks held by exploit/193.\n\nReturn immediately on the pre-lock copy_from_user() failure and keep the\ncommon unlock label for the post-lock paths only.","state":0,"publishedAt":"2026-08-10T11:59:50.667+00:00","modifiedAt":"2026-10-19T20:58:56.123+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/misc/nsm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b9873755a6c8ccfce79094c4dce9efa3ecb1a749\",\n                            \"lessThan\": \"4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b9873755a6c8ccfce79094c4dce9efa3ecb1a749\",\n                            \"lessThan\": \"8f068342096b027181b168d91fef7ac7a2c64b25\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b9873755a6c8ccfce79094c4dce9efa3ecb1a749\",\n                            \"lessThan\": \"f318f5a872cb9096536e759b23ae5c9873bb80ed\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b9873755a6c8ccfce79094c4dce9efa3ecb1a749\",\n                            \"lessThan\": \"ce1fed11d18e163baf7f875152a33bf80f625c1a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/misc/nsm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb","https://git.kernel.org/stable/c/8f068342096b027181b168d91fef7ac7a2c64b25","https://git.kernel.org/stable/c/f318f5a872cb9096536e759b23ae5c9873bb80ed","https://git.kernel.org/stable/c/ce1fed11d18e163baf7f875152a33bf80f625c1a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68179","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68179","identifiers":["CVE-2026-68179"]},"retained":false,"historicalAffected":[]}],"coverage":[]}