CVE-2026-68178
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, the NSM misc driver does not set the owner field in file operations, so opening /dev/nsm does not take a module reference. If the driver is a module, an open file descriptor can survive rmmod, leading to calls into unloaded code. The fix sets owner to THIS_MODULE.
Risk Assessment
The risk includes use-after-free and potential privilege escalation or system crash after module removal.
Recommendation
Update the Linux kernel to a version with the fix that ensures proper module reference while file descriptors are open.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open misc_open() installs a misc driver's file operations with fops_get(), which pins file_operations::owner before replacing the file's f_op. The NSM misc device leaves nsm_dev_fops.owner unset, so opening /dev/nsm does not take a module reference on the nsm driver. If the driver is built as a module, an open file descriptor can therefore survive rmmod of the module that provides its ioctl callbacks. A later ioctl through that descriptor can call into unloaded module text. Set nsm_dev_fops.owner to THIS_MODULE so the misc core holds the module while any /dev/nsm file descriptor is open, matching the lifetime expectation for the installed file operations.