VYPR
Unrated severityNVD Advisory· Published Aug 10, 2026

CVE-2026-68357

CVE-2026-68357

Description

In the Linux kernel, the following vulnerability has been resolved:

watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()

When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to default_gov.

If the governor being unregistered is currently set as default_gov, the default_gov is never cleared. This leads to 2 use-after-free issues: 1. New watchdog devices registered after this point will inherit the dangling default_gov. 2. Existing watchdog devices using the unregistered governor will have their wdd->gov reassigned to the dangling default_gov.

Fix the UAF by clearing default_gov if it matches the governor being unregistered.

Affected products

1

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.