CVE-2026-68178: Linux Kernel NSM Use-After-Free Flaw

CVE-2026-68178 Overview

CVE-2026-68178 is a use-after-free style flaw in the Linux kernel's Nitro Security Module (NSM) misc device driver. The nsm_dev_fops.owner field is left unset, so opening /dev/nsm does not increment the module's reference count. An open file descriptor can survive rmmod of the NSM module. A subsequent ioctl call through that descriptor dispatches into freed module text, producing kernel memory corruption or code execution in kernel context.

Critical Impact
A local user with access to /dev/nsm can trigger execution of freed kernel code by issuing ioctl calls after the NSM module is unloaded, leading to privilege escalation or kernel compromise.

Affected Products

Linux kernel builds that compile the NSM misc driver as a loadable module (CONFIG_NSM=m)
Nitro Enclaves-capable Linux distributions shipping the NSM driver
Downstream kernels prior to the fixes in the referenced stable commits

Discovery Timeline

2026-08-10 - CVE-2026-68178 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68178

Vulnerability Analysis

The Linux misc character device subsystem uses misc_open() to install a driver's file_operations onto a newly opened file. misc_open() calls fops_get(), which invokes try_module_get() on file_operations::owner before replacing the file's f_op pointer. This mechanism pins the module that owns the callbacks for the lifetime of the open descriptor.

The NSM driver defines its nsm_dev_fops structure without setting the .owner field. fops_get() therefore has no module to pin, and /dev/nsm file descriptors do not hold a reference on the NSM module. Because rmmod succeeds while descriptors are still open, the kernel frees the module's .text section while the file's f_op pointers still reference functions inside it.

Any subsequent ioctl(2) on the surviving descriptor dereferences f_op->unlocked_ioctl and jumps into freed memory. The freed pages may be reused for arbitrary allocations, producing kernel memory corruption or attacker-controlled instruction execution in ring 0.

Root Cause

The root cause is a missing .owner = THIS_MODULE initializer in the NSM driver's file_operations structure. This is a lifetime tracking defect [CWE-416] where the module's reference count does not reflect outstanding users of its code.

Attack Vector

Exploitation requires local access with permission to open /dev/nsm and the ability to unload the module, or a race in which an administrator unloads NSM while an unprivileged process holds the descriptor open. The attacker opens /dev/nsm, waits for or induces module removal, then issues an ioctl to trigger dispatch into freed kernel text. Heap grooming of the freed module pages enables controlled kernel code execution.

No verified public exploit code is available. See the upstream fix commit for the corrected driver initializer.

Detection Methods for CVE-2026-68178

Indicators of Compromise

Kernel oops or general protection fault referencing addresses inside a freed module region after an rmmod nsm operation
Processes holding open file descriptors to /dev/nsm across module unload events
Unexpected ioctl activity against /dev/nsm from unprivileged user contexts

Detection Strategies

Audit /proc/*/fd for open handles to /dev/nsm correlated with delete_module syscalls in the audit log
Monitor dmesg for BUG:, Oops:, or Unable to handle kernel paging request events following module unloads
Alert on any userspace process invoking init_module/delete_module on the nsm module outside expected maintenance windows

Monitoring Recommendations

Enable kernel audit rules for delete_module and finit_module syscalls
Ingest /var/log/kern.log and journalctl -k output into centralized logging and search for NSM references in fault traces
Track kernel version and NSM module build type across the fleet to identify hosts running vulnerable module builds

How to Mitigate CVE-2026-68178

Immediate Actions Required

Apply the vendor kernel update that includes the upstream fix setting nsm_dev_fops.owner = THIS_MODULE
Restrict permissions on /dev/nsm to trusted users and services only
Prevent unprivileged users from loading or unloading kernel modules by locking down CAP_SYS_MODULE

Patch Information

The fix is present in the following stable kernel commits: 1996639f824c, 1da310b94504, 3b231f1e9990, and 9e9a82d00c3d. Update to a kernel that incorporates these commits and reboot affected hosts.

Workarounds

Build the NSM driver statically into the kernel (CONFIG_NSM=y) so it cannot be unloaded
Blacklist the nsm module on systems that do not require Nitro Enclaves attestation
Enforce module signature verification and disable runtime module unloading via CONFIG_MODULE_UNLOAD=n where feasible

bash

# Prevent loading of the vulnerable module until patched
echo 'blacklist nsm' | sudo tee /etc/modprobe.d/nsm-blacklist.conf
sudo update-initramfs -u

# Restrict /dev/nsm access to root only
sudo chmod 0600 /dev/nsm