5.7

CVE-2026-68312: linux

CVSS: 5.7v4.0MediumReceived
AliasesUBUNTU-CVE-2026-68312DEBIAN-CVE-2026-68312
Published 10-08-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-68312 is a medium (CVSS 5.7) vulnerability in linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9% of scored vulnerabilities.

Overall risk
23/100
0100
Low · default modelHow is this calculated?
CVSS score
5.7/10
010
Medium · v4.0 (OSV · Ubuntu), selected by version preference
EPSS score
0.20%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 17
OPENSUSE-SU-2026:22091-1SUSE-SU-2026:23477-1SUSE-SU-2026:23481-1SUSE-SU-2026:23528-1SUSE-SU-2026:23529-1SUSE-SU-2026:24179-1

Timeline

  1. 10-08-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifs_close_deferred_file(), cifs_close_all_deferred_files(), and cifs_close_deferred_file_under_dentry(), when a pending deferred close is cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to add the file to the local processing list may fail under memory pressure. The loop breaks immediately, but the cancelled work is no longer pending (it would have called _cifsFileInfo_put()), and the cfile is never added to file_head for processing. The cifsFileInfo reference and the open server handle both leak. Fix by saving the cfile that failed allocation in a local variable, breaking as before, and calling _cifsFileInfo_put() on it after releasing the lock. Any files later in the iteration are unaffected since their deferred work is still pending and will fire normally.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

+0.01 pp

From 0.19% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linuxAll versions (No fix recorded) | < 7.0.0-38.38
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 7.0.0-1014.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linuxAll versions (No fix recorded) | < 7.1.6-1
Linux1 product
  • linux≥ e3fc065682ebbbd15b0ce0036800f4acbf765d46, < c968b2417f6a15d35ff4b97d534af4a126cb510b | ≥ e3fc065682ebbbd15b0ce0036800f4acbf765d46, < 7af7ec3af091f55d01f0ebe0246d10e37f358311 | ≥ e3fc065682ebbbd15b0ce0036800f4acbf765d46, < 6089f561e2c31a3ba52836c75c7d2ab50d2eea41 | ≥ e3fc065682ebbbd15b0ce0036800f4acbf765d46, < 32390b3f06f26e366cfb27dbac4bc0196c321535 | ≥ e3fc065682ebbbd15b0ce0036800f4acbf765d46, < c2f2e83e3bbc5483730fd4ee903182761f1ae50f | 5.15

3 vendors · 159 products

References

14 links
Show all 14 references