What is the CVSS score of EUVD-2026-55280?

EUVD-2026-55280 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel NSM are affected by EUVD-2026-55280?

CVE-2026-68179 affects the Linux kernel's Nitro Security Module in AWS Nitro Enclaves, enabling local processes to corrupt kernel locking state through a mutex unlock imbalance.. A patch is available.

How to fix or mitigate EUVD-2026-55280?

Within 24 hours, audit systems running AWS Nitro Enclaves to identify kernel versions vulnerable to CVE-2026-68179 and prioritize affected hosts for patching. Within 7 days, deploy the vendor-released kernel patch to all affected Nitro Enclave systems and coordinate controlled reboots during maintenance windows to minimize service disruption. Within 30 days, validate remediation across the inventory using kernel version attestation and confirm Lockdep warnings are absent from system logs.

Linux Kernel NSM EUVD-2026-55280

| CVE-2026-68179 HIGH

2026-08-10 Linux

GHSA-3jf9-7qhv-4pm6

Information Disclosure Linux

8.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.4 HIGH

Local vector confirmed; PR:N reflects enclave context; AC:H because exploiting mutex corruption beyond crash requires significant additional sophistication.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:40 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

8.4 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 11:59 cve.org

HIGH 8.4

CVE Published

Aug 10, 2026 - 11:59 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

misc: nsm: only unlock nsm_dev on post-lock error paths

nsm_dev_ioctl() jumps to the common out label even when the initial copy_from_user() fails before nsm->lock has been taken. The error path then blindly unlocks a mutex that was never acquired.

This issue was found by our static analysis tool and then manually reviewed against the current tree.

The grounded PoC kept the miscdevice ioctl entry and the pre-lock copy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing NSM_IOCTL_RAW with an invalid user pointer. That failure reaches the shared out label before mutex_lock(&nsm->lock). Lockdep reported:

WARNING: bad unlock balance detected! exploit/193 is trying to release lock (&global_nsm.lock) at: nsm_dev_ioctl+0x5f/0xcf [vuln_msv] but there are no more locks to release! no locks held by exploit/193.

Return immediately on the pre-lock copy_from_user() failure and keep the common unlock label for the post-lock paths only.

AnalysisAI

Mutex unlock imbalance in the Linux kernel's Nitro Security Module (NSM) ioctl handler allows a local process to corrupt kernel locking state by supplying an invalid user pointer to NSM_IOCTL_RAW. The nsm_dev_ioctl() function's pre-lock copy_from_user() failure path incorrectly reaches the shared out label, which unconditionally calls mutex_unlock() on a mutex that was never acquired - triggering a bad-unlock-balance condition confirmed by Lockdep. Systems running AWS Nitro Enclaves on affected kernel versions are exposed; no public weaponized exploit exists but a functional PoC triggering the Lockdep warning is documented in the upstream commit itself, and EPSS sits at 0.20% (10th percentile), indicating no widespread exploitation observed to date.

Technical ContextAI

The misc/nsm.c driver implements the AWS Nitro Security Module - a hardware attestation and entropy device exposed as a Linux miscdevice (/dev/nsm) exclusively within AWS Nitro Enclave VMs. The ioctl handler nsm_dev_ioctl() uses a single shared out label for all cleanup, including mutex_unlock(&nsm->lock). When the initial copy_from_user(&raw, argp, _IOC_SIZE(cmd)) fails - for example, because the userspace pointer is invalid - the function jumps to out before mutex_lock() has ever been called. This is a classic improper locking path error (analogous to CWE-667), where a single cleanup label cannot safely serve both pre-lock and post-lock error paths. The CPE strings (cpe:2.3:a:linux:linux) confirm the Linux kernel is the affected product. The fix separates the error paths so that the pre-lock failure returns immediately, and the shared out label is reserved for post-lock paths only.

RemediationAI

The primary remediation is upgrading the Linux kernel to a patched stable release: 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 or later, which apply the upstream fix separating pre-lock and post-lock error paths in nsm_dev_ioctl(). Fix commits are available at https://git.kernel.org/stable/c/8f068342096b027181b168d91fef7ac7a2c64b25, https://git.kernel.org/stable/c/f318f5a872cb9096536e759b23ae5c9873bb80ed, https://git.kernel.org/stable/c/ce1fed11d18e163baf7f875152a33bf80f625c1a, and https://git.kernel.org/stable/c/4aa3f7d48e91eb74a363c1b4d7dbdd28f5b341fb. For workloads where immediate kernel update is not possible, a compensating control is to restrict access to the /dev/nsm device node via DAC permissions (e.g., chmod 0600 /dev/nsm and limit ownership to a trusted service account), which prevents arbitrary unprivileged processes inside the enclave from issuing ioctls; trade-off is that legitimate NSM consumers also lose access until the kernel is patched. Operators not using Nitro Enclave attestation features may compile the kernel with CONFIG_NSM disabled to eliminate the attack surface entirely.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-55280 vulnerability details – vuln.today

Back

Linux Kernel NSM EUVD-2026-55280

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code