Skip to main content

Linux Kernel CVE-2026-68228

| EUVDEUVD-2026-55329 HIGH
2026-08-10 Linux GHSA-rh59-gx8h-f2g3
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition requires precise timing between IRQ callback and userspace re-queue, warranting AC:H; PR:L reflects mandatory video device node access.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:39 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:00 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: chips-media: wave5: Move src_buf Removal to finish_encode

During encoder processing, there is a case where the IRQ response could return the buffer back to userspace via v4l2_m2m_buf_done call. In this time, userspace could queue up this same buffer before start_encode removes the index from the ready queue. This would then lead to a case where the buffer in the ready queue could be a self loop due to the WRITE_ONCE(prev->next, new) call in __list_add.

When __list_del is finally called, the loop is already made so nothing points back to ready queue list head and pointers are poisoned.

A buffer should not be marked as DONE before the buffer is removed from m2m ready queue. Move removal entirely to finish_encode.

AnalysisAI

Race condition in the chips-media Wave5 video encoder driver of the Linux kernel corrupts the V4L2 M2M ready queue linked list, enabling local privilege escalation. The IRQ handler returns a source buffer to userspace via v4l2_m2m_buf_done before removing it from the ready queue; if userspace re-queues that buffer before start_encode cleans up the index, __list_add creates a self-referential loop that __list_del cannot resolve, poisoning kernel list pointers. A low-privileged local user on a system with Wave5 hardware can trigger kernel memory corruption, leading to a crash or potential escalation to root. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects very low near-term weaponization probability.

Technical ContextAI

The vulnerability resides in the chips-media Wave5 hardware video encoder driver within the Linux kernel's V4L2 Memory-to-Memory (M2M) subsystem. The M2M framework maintains a doubly-linked 'ready queue' of source buffers awaiting encoding. During IRQ handling, v4l2_m2m_buf_done() signals buffer completion to userspace before start_encode() removes the corresponding index from the ready queue - a TOCTOU window. If userspace re-queues the same buffer during this window, __list_add() executes WRITE_ONCE(prev->next, new), making the entry point to itself. When __list_del() is subsequently called, the circular reference prevents the list head from ever being found, and pointers are set to LIST_POISON1/LIST_POISON2 - the kernel's deliberate corruption sentinel. No CWE is formally assigned, but this maps to CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization / Race Condition) with secondary CWE-416 (Use After Free) characteristics. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, confined to kernels with the Wave5 driver compiled in.

RemediationAI

Upgrade to a patched Linux kernel: version 6.12.101, 6.18.42, 7.1.6, or later in their respective stable series, or pull 7.2-rc1 for the development branch. The four fix commits can be reviewed at https://git.kernel.org/stable/c/1ee2b2b189ddc7b23c8eee1145de42b8bd19fb06, https://git.kernel.org/stable/c/f24ca8b53fe15db40957bdaa40c9aa68e1557bbe, https://git.kernel.org/stable/c/d681227ce43bfd74b6eb69beecd9b0bec1fd8b48, and https://git.kernel.org/stable/c/b20157147089a9c16a38c7810e2fe6f2df8e3277. For systems that cannot be patched immediately, two compensating controls apply: first, restrict access to the video device node (e.g., /dev/video*) using udev rules or strict DAC permissions so only explicitly trusted users or service accounts can open the encoder - this raises the exploitation barrier from any local user to a narrower trusted set, though it does not eliminate the race condition itself. Second, if Wave5 encoding functionality is not required, blacklist the wave5 kernel module by adding 'blacklist wave5' to /etc/modprobe.d/blacklist.conf and rebooting, which eliminates the attack surface entirely at the cost of hardware video encoding capability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68228 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy