{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "b9873755a6c8ccfce79094c4dce9efa3ecb1a749"
            },
            {
              "fixed": "4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb"
            },
            {
              "fixed": "8f068342096b027181b168d91fef7ac7a2c64b25"
            },
            {
              "fixed": "f318f5a872cb9096536e759b23ae5c9873bb80ed"
            },
            {
              "fixed": "ce1fed11d18e163baf7f875152a33bf80f625c1a"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.8.0"
            },
            {
              "fixed": "6.12.101"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.42"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68179.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: nsm: only unlock nsm_dev on post-lock error paths\n\nnsm_dev_ioctl() jumps to the common out label even when the initial\ncopy_from_user() fails before nsm-\u003elock has been taken.  The error path\nthen blindly unlocks a mutex that was never acquired.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the miscdevice ioctl entry and the pre-lock\ncopy_from_user(\u0026raw, argp, _IOC_SIZE(cmd)) failure path by issuing\nNSM_IOCTL_RAW with an invalid user pointer.  That failure reaches the\nshared out label before mutex_lock(\u0026nsm-\u003elock).  Lockdep reported:\n\n  WARNING: bad unlock balance detected!\n  exploit/193 is trying to release lock (\u0026global_nsm.lock) at:\n  nsm_dev_ioctl+0x5f/0xcf [vuln_msv]\n  but there are no more locks to release!\n  no locks held by exploit/193.\n\nReturn immediately on the pre-lock copy_from_user() failure and keep the\ncommon unlock label for the post-lock paths only.",
  "id": "CVE-2026-68179",
  "modified": "2026-08-14T03:52:06.157095833Z",
  "published": "2026-08-10T11:59:50.667Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8f068342096b027181b168d91fef7ac7a2c64b25"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ce1fed11d18e163baf7f875152a33bf80f625c1a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f318f5a872cb9096536e759b23ae5c9873bb80ed"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68179.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68179"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "misc: nsm: only unlock nsm_dev on post-lock error paths"
}