CVE-2026-68181 in Linux
Zusammenfassung
von MITRE • 10.08.2026
In the Linux kernel, the following vulnerability has been resolved:
mei: bus: access mei_device under device_lock on cleanup
Fix couple of problems in mei_cl_bus_dev_release():
mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus.
Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus).
This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.