CVE-2026-68357
Last modified
CVE-2026-68357 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If the governor being unregistered is currently set as `default_gov`, the `default_gov` is never cleared. This leads to 2 use-after-free issues: 1.
Description
In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If the governor being unregistered is currently set as `default_gov`, the `default_gov` is never cleared. This leads to 2 use-after-free issues: 1. New watchdog devices registered after this point will inherit the dangling `default_gov`. 2. Existing watchdog devices using the unregistered governor will have their `wdd->gov` reassigned to the dangling `default_gov`. Fix the UAF by clearing `default_gov` if it matches the governor being unregistered.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= da0d12ff2b829a35e9921918e925d79497b82bef, < 2e47b91b9b4020fcc01def14d6b6556d66074cf4; >= da0d12ff2b829a35e9921918e925d79497b82bef, < 0ca252720f0e38411cfec3431db9bb1aed0a412c; >= da0d12ff2b829a35e9921918e925d79497b82bef, < 7d1658b066de30f4b23afc14814d22416a971e6e; >= da0d12ff2b829a35e9921918e925d79497b82bef, < 7993d626983cc58fbde9607333cfd2d57725c197; >= da0d12ff2b829a35e9921918e925d79497b82bef, < 7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661 |
| Linux | Linux | 4.9 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-68357?
How severe is CVE-2026-68357?
How do I fix CVE-2026-68357?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-68351In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68352In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68353In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68354In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68355In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68356In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68358In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68359In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68360In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68361In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68362In the Linux kernel, the following vulnerability has been re…
- CVE-2026-68363In the Linux kernel, the following vulnerability has been re…
Are you affected by CVE-2026-68357?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST