CVE-2026-68144

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> phonet: pep: fix use-after-free in pep_get_sb()<br /> <br /> pep_get_sb() doesn&amp;#39;t consider that pskb_may_pull() might have relocated<br /> the skb data, and continue to access the older pointer, causing UAF.<br /> <br /> Reproduced under KASAN:<br /> <br /> BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0<br /> Read of size 1 at addr ff11000105510f50 by task repro/157<br /> pep_get_sb+0x234/0x3b0<br /> pipe_handler_do_rcv+0x5f7/0xa10<br /> pep_do_rcv+0x203/0x410<br /> __sk_receive_skb+0x471/0x4a0<br /> phonet_rcv+0x5b3/0x6c0<br /> __netif_receive_skb+0xcc/0x1d0<br /> <br /> Refetch the header with skb_header_pointer() after pskb_may_pull(), so<br /> the possibly stale pointer is no longer dereferenced. There are better<br /> ways to solve this, but, this is the less instrusive one.