CVE-2026-68332

CVE CVE-2026-68332EUVD EUVD-2026-55433Published 2026-08-10T12:03:08.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix potential use-after-free in airoha_ppe_deinit() airoha_ppe_deinit() replaces the NPU pointer with NULL via rcu_replace_pointer() but does not wait for existing RCU readers to exit before calling ppe_deinit() and airoha_npu_put(). This can cause a use-after-free if a reader in an RCU read-side critical section still holds a reference to the NPU when it is freed. The init path (airoha_ppe_init) already calls synchronize_rcu() after rcu_assign_pointer(), but the deinit path introduced in commit 6abcf751bc08 ("net: airoha: Fix schedule while atomic in airoha_ppe_deinit()") omitted the matching barrier when switching from rcu_read_lock()/rcu_dereference() to rcu_replace_pointer(). Add synchronize_rcu() before ppe_deinit() to ensure all existing RCU readers have completed before the NPU resources are released.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 6.18.6 <6.18.42; 6abcf751bc084804a9e5b3051442e8a2ce67f48a <ad28c4f9e0eae4993cb3fde3e7cea330acd8b97c; patch: 6.18.42; 6abcf751bc084804a9e5b3051442e8a2ce67f48a <2484568a335cd7bda951c75b3a7d95ea36161ae7; patch: 7.1.6; 6.19; patch: 7.2-rc5; patch: 0; 72f93dc6d1a6b157e0c3d247085c74935893cca0 <46e3bed4b071095ecc9384a7b349e1908728531f

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.