CVE-2026-68181
In the Linux kernel, the following vulnerability has been resolved: mei: bus: access mei_device under device_lock on cleanup Fix couple of problems in mei_cl_bus_dev_release(): mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus. Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus). This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too.
Affected versions
Linux kernel versions
6.1.149,
6.6.103,
6.12.43,
6.15.11,
6.16.2,
6.17
and later are affected. Fixed in
6.1.184,
6.6.148,
6.12.101,
6.18.42,
7.1.6,
7.2
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-68181?
CVE-2026-68181 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.1.149 onward and has been patched in 6.1.184, 6.6.148, 6.12.101 and others. CVE-2026-68181 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-68181?
Yes. CVE-2026-68181 has been patched. Fixed versions include 6.1.184, 6.6.148, 6.12.101 and others. If you are running Linux kernel 6.1.149 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-68181 actively exploited?
No. CVE-2026-68181 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.