CVE-2026-68144: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68144 Overview

CVE-2026-68144 is a use-after-free (UAF) vulnerability in the Linux kernel's Phonet protocol implementation, specifically in the pep_get_sb() function within the Phonet Pipe Endpoint (PEP) subsystem. The flaw occurs because pep_get_sb() does not account for the possibility that pskb_may_pull() relocates the socket buffer (skb) data, leaving the function operating on a stale pointer. An attacker who can deliver crafted Phonet packets to the kernel receive path can trigger memory access on freed memory. The issue was confirmed under Kernel Address Sanitizer (KASAN), which reported a slab-use-after-free during pep_get_sb() execution.

Critical Impact
Network-reachable use-after-free in the Linux kernel Phonet PEP receive path enabling potential remote code execution, information disclosure, or denial of service without authentication.

Affected Products

Linux kernel — Phonet protocol subsystem (net/phonet)
Linux kernel builds compiled with Phonet PEP support enabled
Distributions shipping vulnerable stable kernel branches until patched commits are backported

Discovery Timeline

2026-08-10 - CVE-2026-68144 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68144

Vulnerability Analysis

The vulnerability lives in pep_get_sb(), a helper used by the Phonet Pipe Endpoint receive path. The function retrieves a Phonet subblock header from an incoming sk_buff. Before parsing, the code calls pskb_may_pull() to ensure the required bytes are linear and accessible. pskb_may_pull() may reallocate the skb head to satisfy the pull request. When this happens, any pointer previously derived from the skb data becomes stale.

The existing implementation retains and dereferences the pre-pull pointer after pskb_may_pull() succeeds. Reading from that pointer accesses freed slab memory. KASAN reports the condition as slab-use-after-free in pep_get_sb+0x234/0x3b0, triggered along the call chain phonet_rcv → __sk_receive_skb → pep_do_rcv → pipe_handler_do_rcv → pep_get_sb.

The upstream fix refetches the header using skb_header_pointer() after the pskb_may_pull() call, so the code no longer relies on the potentially invalidated pointer. This falls under [CWE-416: Use After Free] in the kernel networking stack.

Root Cause

The root cause is a violation of the skb data-pointer lifetime contract. pskb_may_pull() can relocate the skb linear buffer, invalidating pointers computed before the call. pep_get_sb() cached a header pointer before pulling additional bytes and reused it afterward. When reallocation occurred, subsequent reads landed in memory the allocator had already freed and potentially reused.

Attack Vector

The attack vector is network-adjacent through the Phonet protocol receive path. An attacker capable of injecting Phonet frames into the target's network stack can craft messages that force pskb_may_pull() to reallocate the skb head during PEP processing. Successful triggering yields a read of freed memory inside pep_get_sb(). Depending on heap state, this can be leveraged for information disclosure, kernel memory corruption, or a kernel panic causing denial of service.

No verified public exploit code is available. The KASAN reproducer referenced in the upstream commit demonstrates triggering the condition but is not weaponized.

Detection Methods for CVE-2026-68144

Indicators of Compromise

Kernel oops or panic entries referencing pep_get_sb, pipe_handler_do_rcv, pep_do_rcv, or phonet_rcv in dmesg or /var/log/kern.log.
KASAN reports of slab-use-after-free in the Phonet PEP call chain on instrumented builds.
Unexpected Phonet traffic on hosts that do not use cellular modem stacks or Nokia-era telephony peripherals.

Detection Strategies

Inventory running kernels against the fixed commits (0f71f852a96a, 17f78c0c0d41, 25e3641beb51, 8d931a75a38b, a48a889b60f7) and flag hosts running unpatched versions.
Monitor for loading of the phonet and pn_pep kernel modules on systems where they are not required, and alert on module load events via auditd.
Deploy runtime kernel crash telemetry that captures stack traces containing Phonet symbols for retrospective triage.

Monitoring Recommendations

Forward kernel logs and audit events to a centralized platform and alert on repeated crashes referencing networking subsystems.
Track unexpected reboots on Linux hosts that expose non-standard protocol handlers to untrusted networks.
Review baseline for lsmod output changes across managed Linux fleets, prioritizing servers, IoT, and embedded devices.

How to Mitigate CVE-2026-68144

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org stable commits as soon as vendor packages are available.
Blacklist the Phonet module on systems that do not require it by adding blacklist phonet and blacklist pn_pep under /etc/modprobe.d/.
Reboot affected hosts after patching to ensure the vulnerable code path is no longer resident in memory.

Patch Information

The fix refetches the Phonet subblock header via skb_header_pointer() after pskb_may_pull() returns, preventing use of the stale pointer. Fixed changes are available in the following upstream commits: 0f71f852a96a, 17f78c0c0d41, 25e3641beb51, 8d931a75a38b, and a48a889b60f7. Track distribution security advisories for backported package updates.

Workarounds

Disable the Phonet protocol module (phonet, pn_pep) on any host that does not require cellular modem AT-command support.
Restrict access to network interfaces that could deliver Phonet frames to unprivileged users or untrusted networks.
Enable KASAN in test environments to detect regressions during patch validation before deploying to production kernels.

bash

# Configuration example: block Phonet modules from loading
echo 'blacklist phonet' | sudo tee /etc/modprobe.d/disable-phonet.conf
echo 'blacklist pn_pep' | sudo tee -a /etc/modprobe.d/disable-phonet.conf
echo 'install phonet /bin/true' | sudo tee -a /etc/modprobe.d/disable-phonet.conf
echo 'install pn_pep /bin/true' | sudo tee -a /etc/modprobe.d/disable-phonet.conf
sudo update-initramfs -u
sudo reboot