CVE-2026-68179 Overview
CVE-2026-68179 is a locking flaw in the Linux kernel's Nitro Secure Module (NSM) miscellaneous driver. The nsm_dev_ioctl() function releases nsm->lock on an error path that runs before the mutex is acquired. When the initial copy_from_user() fails, control jumps to a shared out label that unconditionally calls mutex_unlock(), producing a bad unlock balance and corrupting mutex accounting. Local users able to invoke the NSM ioctl interface can trigger the condition by passing an invalid user pointer to NSM_IOCTL_RAW. Lockdep flags the imbalance at runtime, and the resulting state affects kernel integrity and availability.
Critical Impact
A local attacker can corrupt kernel mutex state through a single ioctl call with an invalid user pointer, compromising confidentiality, integrity, and availability of the affected system.
Affected Products
- Linux kernel versions containing the NSM miscellaneous driver prior to the fix
- Systems exposing the NSM device node to unprivileged users
- AWS Nitro Enclave guests and any distribution shipping the nsm driver
Discovery Timeline
- 2026-08-10 - CVE-2026-68179 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68179
Vulnerability Analysis
The defect resides in the nsm_dev_ioctl() handler of the NSM misc driver. The function copies the ioctl argument from user space using copy_from_user(&raw, argp, _IOC_SIZE(cmd)) before acquiring nsm->lock. When this copy fails, the function jumps to a shared out label that calls mutex_unlock(&nsm->lock). Because the mutex was never taken on this path, the unlock is applied to a lock the current task does not hold. Lockdep records this as: WARNING: bad unlock balance detected! with the message nsm_dev_ioctl+0x5f/0xcf ... but there are no more locks to release!.
The underlying weakness is a control-flow error in cleanup handling, closely related to [CWE-667] Improper Locking. Consult the upstream fixes for the exact code changes in commits 4aa3f7d, 8f06834, ce1fed1, and f318f5a.
Root Cause
The root cause is a single shared cleanup label used by both pre-lock and post-lock error paths. The pre-lock copy_from_user() failure branch reuses the same out label as the post-lock branches, but that label performs an unconditional mutex_unlock(). This violates the invariant that unlock and lock calls must be balanced within a control-flow region.
Attack Vector
Exploitation requires local access and the ability to open the NSM character device and issue an ioctl. An attacker calls NSM_IOCTL_RAW with a deliberately invalid user-space pointer as the argument. The kernel enters nsm_dev_ioctl(), fails the initial copy_from_user(), and jumps to the shared out label. The mutex_unlock() then executes against a mutex the caller never acquired, poisoning the mutex owner tracking and lockdep state. Repeated invocations can destabilize the kernel and enable follow-on attacks against threads that legitimately contend for nsm->lock.
See the upstream commit for the exact call sequence and fix.
Detection Methods for CVE-2026-68179
Indicators of Compromise
- Kernel log entries containing WARNING: bad unlock balance detected! referencing nsm_dev_ioctl
- Lockdep splats naming global_nsm.lock with no locks held by the offending task
- Unexpected EFAULT returns from NSM_IOCTL_RAW correlated with unprivileged processes opening /dev/nsm
Detection Strategies
- Enable CONFIG_PROVE_LOCKING and monitor dmesg for lockdep warnings referencing the nsm module.
- Audit ioctl syscalls against the NSM device using auditd rules watching /dev/nsm.
- Correlate kernel warnings with process identifiers to attribute suspicious ioctl activity to specific users or containers.
Monitoring Recommendations
- Forward kernel ring buffer output to a centralized logging tier and alert on bad unlock balance strings.
- Track unexpected opens of /dev/nsm from processes outside the enclave supervisor.
- Baseline ioctl call rates against NSM and alert on statistical anomalies from non-service accounts.
How to Mitigate CVE-2026-68179
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 4aa3f7d, 8f06834, ce1fed1, and f318f5a.
- Restrict access to /dev/nsm to trusted service accounts using device permissions or udev rules.
- Reboot into the patched kernel to ensure the vulnerable nsm_dev_ioctl() path is replaced.
Patch Information
The fix returns immediately when the pre-lock copy_from_user() fails and reserves the shared unlock label for post-lock error paths only. Patches are available in the stable trees referenced by commits 4aa3f7d, 8f06834, ce1fed1, and f318f5a. Distribution vendors are expected to backport these commits into their supported kernel branches.
Workarounds
- Unload the nsm module on systems that do not require Nitro Secure Module functionality using modprobe -r nsm.
- Blacklist the nsm module in /etc/modprobe.d/ where the driver is not needed for workloads.
- Tighten permissions on /dev/nsm so that only privileged enclave services can open it.
# Restrict NSM device access and blacklist the module where unused
echo 'blacklist nsm' | sudo tee /etc/modprobe.d/blacklist-nsm.conf
sudo chmod 0600 /dev/nsm
sudo chown root:root /dev/nsm
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
