What is the CVSS score of CVE-2026-68379?

CVE-2026-68379 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68379?

A memory exhaustion vulnerability in the Linux kernel TCP stack (CVE-2026-68379) allows remote attackers to trigger denial-of-service conditions against exposed Linux systems.. A patch is available.

How to fix or mitigate CVE-2026-68379?

Within 24 hours, create an inventory of all Linux systems in your infrastructure and identify those exposed to untrusted networks or internet-facing services; prioritize critical systems supporting customer-facing applications. Within 7 days, deploy the available vendor security patch to all identified critical and internet-exposed systems using a staged rollout with testing in non-production environments first. Within 30 days, apply the patch to all remaining Linux systems organization-wide and validate that no systems were missed during the initial deployment.

Linux Kernel CVE-2026-68379

EUVD-2026-55565 HIGH

2026-08-10 Linux

GHSA-hqwg-h56w-34xh

Information Disclosure Linux

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

AC:H because exploitation requires non-default PSP policy configuration; AV:N and PR:N since the trigger is network-delivered with no attacker authentication needed.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:56 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.5 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:03 cve.org

HIGH 7.5

CVE Published

Aug 10, 2026 - 12:03 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix TIME_WAIT socket reference leak on PSP policy failure

Release the TIME_WAIT socket reference and jump to discard_it upon PSP policy failure in both IPv4 and IPv6 receive paths. This prevents a memory leak of tcp_tw_bucket structures.

AnalysisAI

Memory exhaustion in the Linux kernel TCP stack allows remote network-reachable attackers to trigger a reference leak in tcp_tw_bucket structures when PSP (Packet Security Protocol) policy lookup fails during packet processing in both IPv4 and IPv6 receive paths. TIME_WAIT socket references are not released on this failure path, causing a gradual accumulation of unreclaimable kernel memory. The CVSS score of 7.5 (High) reflects the network accessibility and potential for denial-of-service via memory exhaustion, though EPSS at 0.21% (11th percentile) and the absence from CISA KEV indicate no public exploit or confirmed active exploitation at time of analysis.

Technical ContextAI

The Linux kernel TCP implementation maintains TIME_WAIT sockets as lightweight tcp_tw_bucket structures to handle late-arriving packets after a connection closes. The PSP (Packet Security Protocol) is a datacenter-oriented encryption protocol developed by Google and integrated into the Linux kernel, operating as a policy layer beneath TCP. In the affected code path, when the kernel receives a packet destined for a TIME_WAIT socket and the PSP policy lookup or application fails, the fix is missing the requisite sock_put() or equivalent reference decrement before jumping to the discard path. This results in each policy-failure event incrementing the socket's reference count without a corresponding release, constituting a classic CWE-401-style memory resource management failure (though CWE is listed as N/A in NVD). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* for kernel versions beginning at commit 659a2899a57da59f433182eba571881884d6323e.

RemediationAI

Update to a patched kernel release: Linux 6.18.42, Linux 7.1.6, or Linux 7.2-rc4, whichever applies to the deployment. The upstream fix commits are available at https://git.kernel.org/stable/c/e666af5dcc905ba694745963174d232deb478c55, https://git.kernel.org/stable/c/374742a961becbbfc7fbfd1382d978a05e492741, and https://git.kernel.org/stable/c/2c1931a81122c3cdc4c89448fe0442c69e21c0d5. For systems where an immediate kernel upgrade is not feasible, the most effective compensating control is to disable or remove PSP policy configuration, as the vulnerable code path is only reachable when PSP policies are active - this eliminates the trigger entirely but loses PSP-based encryption for datacenter traffic. Alternatively, restricting inbound TCP traffic to TIME_WAIT ports via iptables/nftables firewall rules can limit the rate of triggering, though this does not fully prevent the leak and may interfere with legitimate connection handling. Monitor for abnormal kernel slab allocator growth (e.g., via /proc/slabinfo monitoring for tcp_tw_bucket) as an early indicator.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68379 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68379

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code