CVE-2026-68357 Overview
CVE-2026-68357 is a use-after-free (UAF) vulnerability in the Linux kernel's watchdog pretimeout governor subsystem. The flaw resides in watchdog_unregister_governor(), which fails to clear the default_gov pointer when the governor being unregistered is currently the default. This leaves a dangling reference that new and existing watchdog devices can dereference through wdd->gov.
The vulnerability affects Linux kernel builds that include the watchdog pretimeout framework. Upstream maintainers resolved the issue by clearing default_gov when it matches the governor being unregistered.
Critical Impact
Two distinct use-after-free conditions in the kernel watchdog subsystem can lead to memory corruption, kernel panic, or local privilege escalation.
Affected Products
- Linux kernel with watchdog pretimeout governor support enabled
- Distributions shipping affected mainline and stable kernel branches
- Embedded and server systems relying on kernel watchdog drivers
Discovery Timeline
- 2026-08-10 - CVE-2026-68357 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68357
Vulnerability Analysis
The Linux kernel watchdog subsystem supports pretimeout governors, which decide the action taken when a watchdog device signals an imminent timeout. Governors are registered and unregistered dynamically, and default_gov tracks the fallback governor used when a device's chosen governor becomes unavailable.
When watchdog_unregister_governor() runs, it walks the list of registered watchdog devices and reassigns any device using the departing governor to default_gov. The routine does not verify whether the governor being removed is itself the current default_gov. If it is, the global pointer keeps referencing memory that the caller is about to release.
The result is two overlapping UAF conditions [CWE-416]. First, new watchdog devices registered afterward inherit the dangling default_gov. Second, existing devices that were using the unregistered governor have their wdd->gov reassigned to the same freed pointer.
Root Cause
The root cause is missing state cleanup in watchdog_unregister_governor(). The function updates per-device references but omits the equivalent check for the module-scope default_gov pointer. Because the governor structure is typically owned by a loadable module, unloading that module frees the memory backing the governor while the kernel still holds live references to it.
Attack Vector
A local attacker with the ability to load and unload kernel modules, or to trigger governor unregistration through a vulnerable driver, can drive the kernel into the UAF state. Subsequent watchdog operations that dereference wdd->gov or read default_gov operate on freed memory. Depending on kernel allocator behavior, this can cause a crash, information disclosure, or controlled write primitives suitable for privilege escalation.
No verified public exploit is available. The fix is tracked across multiple stable branches; see the Linux kernel commit 7362ba0f9c96 and the companion stable backports for the corrective patches.
Detection Methods for CVE-2026-68357
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing watchdog_dev, pretimeout, or default_gov in dmesg and /var/log/kern.log.
- KASAN or SLUB debug reports flagging use-after-free access inside watchdog_unregister_governor or watchdog_register_device.
- Unexplained module load/unload sequences involving pretimeout governor modules such as pretimeout_noop or pretimeout_panic.
Detection Strategies
- Enable KASAN or KFENCE on test kernels to surface UAF conditions during watchdog governor churn.
- Audit kernel crash dumps for stack traces terminating in the watchdog pretimeout code path.
- Correlate kernel module load/unload events with subsequent watchdog subsystem faults using host telemetry.
Monitoring Recommendations
- Forward kernel logs to a central data lake and alert on watchdog-related oops signatures.
- Track init_module and delete_module syscalls on production Linux hosts, especially for watchdog and pretimeout modules.
- Baseline the set of loaded kernel modules per host and alert on deviations that include watchdog governor modules.
How to Mitigate CVE-2026-68357
Immediate Actions Required
- Apply the vendor-provided kernel update that includes the fix from the referenced stable commits as soon as it is available for your distribution.
- Restrict CAP_SYS_MODULE and reject unsigned kernel modules via module.sig_enforce=1 to reduce the local attack surface.
- Inventory hosts that dynamically load pretimeout governor modules and prioritize them for patching.
Patch Information
The upstream fix clears default_gov when it matches the governor being unregistered, closing both UAF paths. Corrective commits include 7362ba0f9c96, 2e47b91b9b40, 7993d626983c, 7d1658b066de, and 0ca252720f0e. Rebuild or update to a kernel that incorporates these commits and reboot affected systems.
Workarounds
- Avoid unloading pretimeout governor modules on production hosts until patched kernels are deployed.
- Build kernels with pretimeout governors statically compiled in (=y) rather than as loadable modules to eliminate the unregister path in production.
- Use lockdown mode (kernel.lockdown=integrity) where feasible to constrain module operations by privileged users.
# Verify installed kernel version and pretimeout governor module status
uname -r
lsmod | grep -E 'pretimeout|watchdog'
# Enforce signed modules to reduce untrusted governor load risk
echo 'module.sig_enforce=1' | sudo tee -a /etc/default/grub.d/99-modsig.cfg
sudo update-grub
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
