CVE-2026-68179

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> misc: nsm: only unlock nsm_dev on post-lock error paths<br /> <br /> nsm_dev_ioctl() jumps to the common out label even when the initial<br /> copy_from_user() fails before nsm-&gt;lock has been taken. The error path<br /> then blindly unlocks a mutex that was never acquired.<br /> <br /> This issue was found by our static analysis tool and then manually<br /> reviewed against the current tree.<br /> <br /> The grounded PoC kept the miscdevice ioctl entry and the pre-lock<br /> copy_from_user(&amp;raw, argp, _IOC_SIZE(cmd)) failure path by issuing<br /> NSM_IOCTL_RAW with an invalid user pointer. That failure reaches the<br /> shared out label before mutex_lock(&amp;nsm-&gt;lock). Lockdep reported:<br /> <br /> WARNING: bad unlock balance detected!<br /> exploit/193 is trying to release lock (&amp;global_nsm.lock) at:<br /> nsm_dev_ioctl+0x5f/0xcf [vuln_msv]<br /> but there are no more locks to release!<br /> no locks held by exploit/193.<br /> <br /> Return immediately on the pre-lock copy_from_user() failure and keep the<br /> common unlock label for the post-lock paths only.