CVE-2026-68090 - Vulnerability Details

- debugobjects: Plug race against a concurrent OOM disable

Description

In the Linux kernel, the following vulnerability has been resolved:

debugobjects: Plug race against a concurrent OOM disable

syzbot reported a puzzling splat:

WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20

stub_timer() is installed as timer callback function in
hrtimer_fixup_assert_init(), which is invoked when
debug_object_assert_init() can't find a shadow object. In that case debug
objects emits a warning about it before invoking the fixup.

Though the provided console log lacks this warning and instead has the
following a few seconds before the splat:

ODEBUG: Out of memory. ODEBUG disabled

So the object was looked up in debug_object_assert_init() and the lookup
failed due a concurrent out of memory situation which disabled debug
objects and freed the shadow objects:

debug_object_assert_init()
if (!debug_objects_enabled)
return; obj = alloc();
if (!obj) {
// Out of memory
debug_objects_enabled = false;
free_objects();
obj = lookup_or_alloc();

// The lookup failed because the other side
// removed the objects, so this returns
// an error code as the object in question
// is not statically initialized

if (!IS_ERR_OR_NULL(obj))
return;
if (!obj) {
debug_oom();
return;
}

print(...)
if (!debug_objects_enabled)
return;

fixup(...)

The debug object splat is skipped because debug_objects_enabled is false,
but the fixup callback is invoked unconditionally, which makes the timer
disfunctional.

This is only a problem in debug_object_assert_init() and
debug_object_activate() as both have to handle statically initialized
objects and therefore must handle the error pointer return case
gracefully. All other places only handle the found/not found case and the
NULL pointer return is a signal for OOM. Otherwise they get a valid shadow
object.

Plug the hole by checking whether debug objects are still enabled before
invoking the print and fixup function in those two places.

Published: 2026-08-10

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition occurs in the Linux kernel debug objects subsystem when an out‑of-memory event disables the debug objects feature while a timer callback is still in flight. In this scenario the callback runs unconditionally against a pointer that has been cleared, causing a kernel crash. The crash manifests only when debug objects are enabled and a concurrent OOM occurs; if triggered it can stop the system from responding, leading to a denial of service.

Affected Systems

All Linux kernel implementations that have not incorporated the commit that guards against this race. The CVE provides no explicit version list, so any kernel version before the patch is potentially affected.

Risk and Exploitability

The EPSS score is < 1% and the CVSS score of 5.5 indicates medium severity. Exploitation requires an internal race condition that occurs during a concurrent out‑of-memory event while debug objects are enabled; thus it is a local or privileged scenario with a narrow attack window. No public exploits have been reported, but because a kernel crash can be triggered, the impact is high. Given the complexity of reproducing the race, the overall risk is regarded as moderate.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b84d435cc228e87951f3bbabf6cc4a5f25d5fb16`	affected	< 2d5e320b7ab9b25229ac4331541964a58b5e1d29
`b84d435cc228e87951f3bbabf6cc4a5f25d5fb16`	affected	< 203a965bf2ab43130778d8214fb0c3c8c2d19cdf
`b84d435cc228e87951f3bbabf6cc4a5f25d5fb16`	affected	< 23da32e88627e63e0864f59f4c63a2dc0ab851a3
`b84d435cc228e87951f3bbabf6cc4a5f25d5fb16`	affected	< d663fbf28b2eebe665bb9cf828d7d528e5a8707e
`b84d435cc228e87951f3bbabf6cc4a5f25d5fb16`	affected	< e2e255d07723c330dded8e576ce28a8d23a692ce
`b84d435cc228e87951f3bbabf6cc4a5f25d5fb16`	affected	< c00164c9e7fa6145886ad666806cb5347895de5c
`b84d435cc228e87951f3bbabf6cc4a5f25d5fb16`	affected	< 1f4f02b336c3be125c8fcf87df73db2e0e028b8b
`b84d435cc228e87951f3bbabf6cc4a5f25d5fb16`	affected	< b81dde13cc163450dcb402dcc915ef13ba241e01

Linux

affected

Version	Status	Constraints
`3.3`	affected	—
`0`	unaffected	< 3.3
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Kernel

99%

Version	Status	Scheme	Platform
`[b84d435cc228e87951f3bbabf6cc4a5f25d5fb16,2d5e320b7ab9b25229ac4331541964a58b5e1d29)`	affected	code_commit	—
`[b84d435cc228e87951f3bbabf6cc4a5f25d5fb16,203a965bf2ab43130778d8214fb0c3c8c2d19cdf)`	affected	code_commit	—
`[b84d435cc228e87951f3bbabf6cc4a5f25d5fb16,23da32e88627e63e0864f59f4c63a2dc0ab851a3)`	affected	code_commit	—
`[b84d435cc228e87951f3bbabf6cc4a5f25d5fb16,d663fbf28b2eebe665bb9cf828d7d528e5a8707e)`	affected	code_commit	—
`[b84d435cc228e87951f3bbabf6cc4a5f25d5fb16,e2e255d07723c330dded8e576ce28a8d23a692ce)`	affected	code_commit	—
`[b84d435cc228e87951f3bbabf6cc4a5f25d5fb16,c00164c9e7fa6145886ad666806cb5347895de5c)`	affected	code_commit	—
`[b84d435cc228e87951f3bbabf6cc4a5f25d5fb16,1f4f02b336c3be125c8fcf87df73db2e0e028b8b)`	affected	code_commit	—
`[b84d435cc228e87951f3bbabf6cc4a5f25d5fb16,b81dde13cc163450dcb402dcc915ef13ba241e01)`	affected	code_commit	—

Linux

Kernel

99%

Version	Status	Scheme	Platform
`3.3`	affected	generic	—
`[0,3.3)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the commit adding null‑check guards before invoking print and fixup functions in debug_object_assert_init() and debug_object_activate()
If immediate update is not possible, disable the CONFIG_DEBUG_OBJECTS feature in the kernel configuration to eliminate the race trigger
Ensure no boot parameters enable debug objects; remove any debug_objects boot parameter usage from startup scripts

Generated by OpenCVE AI on August 13, 2026 at 10:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1f4f02b336c3be125c8fcf87df73db2e0e028b8b
https://git.kernel.org/stable/c/203a965bf2ab43130778d8214fb0c3c8c2d19cdf
https://git.kernel.org/stable/c/23da32e88627e63e0864f59f4c63a2dc0ab851a3
https://git.kernel.org/stable/c/2d5e320b7ab9b25229ac4331541964a58b5e1d29
https://git.kernel.org/stable/c/b81dde13cc163450dcb402dcc915ef13ba241e01
https://git.kernel.org/stable/c/c00164c9e7fa6145886ad666806cb5347895de5c
https://git.kernel.org/stable/c/d663fbf28b2eebe665bb9cf828d7d528e5a8707e
https://git.kernel.org/stable/c/e2e255d07723c330dded8e576ce28a8d23a692ce
https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68090-5323@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68090
https://www.cve.org/CVERecord?id=CVE-2026-68090

History

Thu, 13 Aug 2026 09:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-469

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68090-5323@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68090 https://www.cve.org/CVERecord?id=CVE-2026-68090
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Tue, 11 Aug 2026 03:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux kernel
Vendors & Products		Linux kernel

Mon, 10 Aug 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-469

Mon, 10 Aug 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20 stub_timer() is installed as timer callback function in hrtimer_fixup_assert_init(), which is invoked when debug_object_assert_init() can't find a shadow object. In that case debug objects emits a warning about it before invoking the fixup. Though the provided console log lacks this warning and instead has the following a few seconds before the splat: ODEBUG: Out of memory. ODEBUG disabled So the object was looked up in debug_object_assert_init() and the lookup failed due a concurrent out of memory situation which disabled debug objects and freed the shadow objects: debug_object_assert_init() if (!debug_objects_enabled) return; obj = alloc(); if (!obj) { // Out of memory debug_objects_enabled = false; free_objects(); obj = lookup_or_alloc(); // The lookup failed because the other side // removed the objects, so this returns // an error code as the object in question // is not statically initialized if (!IS_ERR_OR_NULL(obj)) return; if (!obj) { debug_oom(); return; } print(...) if (!debug_objects_enabled) return; fixup(...) The debug object splat is skipped because debug_objects_enabled is false, but the fixup callback is invoked unconditionally, which makes the timer disfunctional. This is only a problem in debug_object_assert_init() and debug_object_activate() as both have to handle statically initialized objects and therefore must handle the error pointer return case gracefully. All other places only handle the found/not found case and the NULL pointer return is a signal for OOM. Otherwise they get a valid shadow object. Plug the hole by checking whether debug objects are still enabled before invoking the print and fixup function in those two places.
Title		debugobjects: Plug race against a concurrent OOM disable
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1f4f02b336c3be125c8fcf87df73db2e0e028b8b https://git.kernel.org/stable/c/203a965bf2ab43130778d8214fb0c3c8c2d19cdf https://git.kernel.org/stable/c/23da32e88627e63e0864f59f4c63a2dc0ab851a3 https://git.kernel.org/stable/c/2d5e320b7ab9b25229ac4331541964a58b5e1d29 https://git.kernel.org/stable/c/b81dde13cc163450dcb402dcc915ef13ba241e01 https://git.kernel.org/stable/c/c00164c9e7fa6145886ad666806cb5347895de5c https://git.kernel.org/stable/c/d663fbf28b2eebe665bb9cf828d7d528e5a8707e https://git.kernel.org/stable/c/e2e255d07723c330dded8e576ce28a8d23a692ce

Subscriptions

Linux Kernel Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T11:51:45.149Z

Updated: 2026-08-17T04:58:38.177Z

Reserved: 2026-07-30T09:28:09.367Z

Link: CVE-2026-68090

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T12:17:21.717

Modified: 2026-08-17T05:18:08.173

Link: CVE-2026-68090

Redhat

Severity : Low

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68090 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T10:45:04Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object