What is the CVSS score of CVE-2026-68387?

CVE-2026-68387 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-68387?

The Linux kernel's CAN raw socket subsystem contains a race condition allowing local low-privileged users to escalate privileges through kernel memory corruption, with no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-68387?

Within 24 hours, identify all systems running CAN raw socket support by checking kernel configuration and auditing active CAN applications in production environments where privilege escalation carries operational risk. Within 7 days, apply the patch available per vendor advisory from your Linux distribution and test in staging environments before production deployment, validating that CAN applications remain stable post-patch. Within 30 days, complete patch rollout across all affected systems and confirm CAN subsystem functionality continues normal operation.

Linux Kernel CVE-2026-68387

EUVD-2026-55573 HIGH

2026-08-10 Linux

GHSA-4vh2-jr7c-6362

Information Disclosure Linux

High

Disputed · 7.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition requires precise thread timing (AC:H); local CAP_NET_RAW holder needed (PR:L, AV:L); successful kernel corruption yields full impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:53 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:04 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

can: raw: add locking for raw flags bitfield

With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock") the formerly separate integer values have been integrated into a single bitfield. This led to a read-modify-write operation when changing a flag in raw_setsockopt() which now needs a locking to prevent concurrent access.

Instead of adding a lock/unlock hell in each of the flag manipulations this patch introduces a wrapper for a new raw_setsockopt_locked() function analogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c

[mkl: use Closes tag instead of Link]

AnalysisAI

Race condition in the Linux kernel's CAN raw socket subsystem allows a local low-privileged user to trigger concurrent read-modify-write operations on the raw flags bitfield, potentially leading to kernel memory corruption and local privilege escalation. Introduced by commit 890e5198a6e5, which consolidated separate integer flags into a single bitfield in struct raw_sock without adequate locking in raw_setsockopt(), any concurrent call path can race to produce inconsistent flag state. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low current exploitation probability despite the high CVSS base score.

Technical ContextAI

The Linux kernel's CAN (Controller Area Network) subsystem provides raw socket access via net/can/raw.c. Commit 890e5198a6e5 ('can: raw: use bitfields to store flags in struct raw_sock') restructured per-flag integer storage into a packed C bitfield inside struct raw_sock. Bitfield write operations in C are NOT atomic - the compiler emits a read-modify-write sequence (load register, mask, OR, store) that is inherently susceptible to concurrent access from multiple threads calling raw_setsockopt() simultaneously. The fix mirrors the isotp_setsockopt_locked() pattern already established in net/can/isotp.c, introducing a raw_setsockopt_locked() wrapper that serialises flag mutation. Although no CWE is formally assigned, this maps directly to CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) and CWE-667 (Improper Locking). Affected CPE is cpe:2.3:a:linux:linux across multiple stable branches anchored at commit 890e5198a6e5.

RemediationAI

The vendor-released patch is available across three stable kernel trees. Apply the appropriate fix commit for your kernel branch: for 6.18.x, upgrade to 6.18.42 or apply commit 1e5185c090589f4146d728ab36417d8a5419f127 from https://git.kernel.org/stable/c/1e5185c090589f4146d728ab36417d8a5419f127; for 7.1.x, upgrade to 7.1.6 or apply commit 00ba4bf8798242253fefc1fa6a78db1d445fd024 from https://git.kernel.org/stable/c/00ba4bf8798242253fefc1fa6a78db1d445fd024; for 7.2-rc4 and later mainline, apply commit 57791aab1129c9405f84bb0882de58967d8b44cd from https://git.kernel.org/stable/c/57791aab1129c9405f84bb0882de58967d8b44cd. If patching is not immediately possible, the primary compensating control is to unload or blacklist the can_raw kernel module ('modprobe -r can_raw' and add 'blacklist can_raw' to /etc/modprobe.d/), which eliminates the attack surface entirely at the cost of disabling all CAN raw socket functionality. Alternatively, restrict CAP_NET_RAW capability via seccomp profiles or system-call filtering to prevent untrusted local users from opening CAN raw sockets.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68387 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68387

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code