What is the CVSS score of EUVD-2026-55279?

EUVD-2026-55279 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-55279?

CVE-2026-68178 in the Linux kernel's Nitro Security Module is a local privilege escalation vulnerability enabling attackers with initial system access to gain complete kernel control.. A patch is available.

How to fix or mitigate EUVD-2026-55279?

Within 24 hours, identify and catalog all systems running the Linux kernel NSM (Nitro Security Module) and evaluate their criticality level for prioritized patching. Within 7 days, apply the vendor-released patch to all NSM-enabled systems, beginning with production and security-critical infrastructure. Within 30 days, complete patch verification across all systems and consider disabling the NSM module if it is not actively required for your environment.

Linux Kernel EUVD-2026-55279

| CVE-2026-68178 HIGH

2026-08-10 Linux

GHSA-785r-497w-84xv

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H reflects the race condition requiring concurrent module unload while fd is held; PR:L because opening /dev/nsm requires local low-privilege access.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:40 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 11:59 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 11:59 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

misc: nsm: pin the module while the device is open

misc_open() installs a misc driver's file operations with fops_get(), which pins file_operations::owner before replacing the file's f_op. The NSM misc device leaves nsm_dev_fops.owner unset, so opening /dev/nsm does not take a module reference on the nsm driver.

If the driver is built as a module, an open file descriptor can therefore survive rmmod of the module that provides its ioctl callbacks. A later ioctl through that descriptor can call into unloaded module text.

Set nsm_dev_fops.owner to THIS_MODULE so the misc core holds the module while any /dev/nsm file descriptor is open, matching the lifetime expectation for the installed file operations.

AnalysisAI

Use-after-unload code execution in the Linux kernel's NSM (Nitro Security Module) misc device allows a local attacker with low privileges to call into freed kernel module text, potentially achieving full kernel compromise. The NSM driver fails to set nsm_dev_fops.owner to THIS_MODULE, meaning misc_open() never increments the module reference count when /dev/nsm is opened. When the nsm module is subsequently unloaded while a file descriptor remains open, a later ioctl through that descriptor jumps into unmapped or reallocated memory. No public exploit code or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), reflecting limited real-world exploitation risk at this time.

Technical ContextAI

The Linux kernel's misc device subsystem (drivers/misc) uses misc_open() to install a driver's file_operations struct via fops_get(), which calls try_module_get() on the owner field to pin the providing module in memory for the lifetime of any open file descriptor. The NSM driver (drivers/misc/nsm.c), introduced for AWS Nitro Enclave support, left nsm_dev_fops.owner as NULL rather than THIS_MODULE. Without an owner, fops_get() has nothing to pin, so rmmod can succeed while /dev/nsm file descriptors are still live. Any subsequent ioctl on such a descriptor dispatches through function pointers that now point into memory the kernel has reclaimed or marked as invalid - a classic use-after-unload pattern. The CWE field is unset in the provided data, but this maps conceptually to CWE-416 (Use After Free) applied to module text rather than heap memory. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to a patched stable kernel: 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 depending on the branch in use. The upstream commits are available directly from git.kernel.org at the four commit hashes referenced in the advisory. Distribution-specific stable updates (RHEL, Ubuntu, Debian, Amazon Linux) should be monitored and applied as they become available. As a compensating control pending a kernel update, administrators can prevent the race condition by ensuring the nsm module is not unloadable while enclave workloads are active - for example, by using modprobe with a persistent refcount hold, or by recompiling the kernel with CONFIG_NSM=y (built-in) rather than CONFIG_NSM=m, which eliminates the module unload path entirely. Restricting /dev/nsm access via udev rules to only enclave-management processes reduces the population of principals who can hold a file descriptor open during an unload event. There are no known adverse side effects to the upstream fix itself, which is a one-line owner assignment.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-55279 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-55279

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code