{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-68095 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-68095 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-68095 and fix it if it is affected.\n\nWhat it is: CVE-2026-68095 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-68095 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-68095/ (Markdown: https://insights.sbomify.com/CVE-2026-68095/index.md)","id":"CVE-2026-68095","markdown":"https://insights.sbomify.com/CVE-2026-68095/index.md","name":"CVE-2026-68095","record":{"aliases":["BELL-CVE-2026-68095","DEBIAN-CVE-2026-68095","GHSA-rjc4-mgwc-phm9","UBUNTU-CVE-2026-68095"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A race condition in the Linux kernel's fuse-uring module can cause an indefinite hang and resource leak during connection abortion, leading to denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: fix race between registration and connection abortion\n\nThis fixes this race:\n- thread a: io_uring_enter -\u003e register sqe -\u003e\n  fuse_uring_create_ring_ent -\u003e allocate ent but doesn't grab queue_ref\n  yet\n- thread b: fuse_conn_destroy() -\u003e fuse_chan_abort() -\u003e\n  fuse_uring_abort() is a no-op due to queue ref being 0\n- thread a: grabs the queue_ref, queue_ref is now 1, rest of\n  fuse_uring_do_register() logic executes\n- thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs\n  and calls\n  \"wait_event(ring-\u003estop_waitq, atomic_read(\u0026ring-\u003equeue_refs) == 0);\"\nThe abort/unmount thread will hang indefinitely in unkillable state as\nnothing will decrement queue_refs or wake stop_waitq, and the ring,\nqueue, and ent are leaked.\n\nFix this by checking fch-\u003econnected under fch-\u003elock after the created\nent has grabbed a ref count on the queue. This ensures that in the\nscenario above, it is guaranteed that we either release the queue ref\nand wake up stop_waitq (in case fuse_chan_wait_aborted() is already\nwaiting) in fuse_uring_do_register() when we detect !fch-\u003econnected, or\nif the connection is aborted after the check, it is guaranteed that the\nasync teardown worker will be running in the background cleaning up ents\nand decrementing the ent's ref on the queue, which will unblock the\neventual queue and ring teardown.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"fuse-uring: fix race between registration and connection abortion","id":"CVE-2026-68095","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"audit: fix recursive locking deadlock in audit_dupe_exe()","id":"CVE-2026-68096"},"packages":[],"prev":{"headline":"sched_ext: Preserve rq tracking across local DSQ dispatch","id":"CVE-2026-68094"},"products":["Linux"],"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"A race condition in the Linux kernel's fuse-uring module can cause an indefinite hang and resource leak during connection abortion, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-68095/"}