CVE-2026-68480 - Vulnerability Details

- x86/bugs: Make Safe-RET robust against interrupt injection

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Make Safe-RET robust against interrupt injection

An attacker injecting interrupts while the Safe-RET mitigation executes
on machines affected by SRSO can neutralize the safe return sequence,
potentially leading to data leakage through speculative execution.

Fixup register state as if the Safe-RET sequence executed successfully
by "emulating" it, in a manner of speaking, and avoid executing a RET
instruction after returning from the interrupt.

Published: 2026-08-06

Score: 8.8 High

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

An attacker can inject interrupts while the Safe-RET mitigation runs on systems that use the SRSO Safe-RET feature, causing the safe return sequence to be prematurely neutralized. The result is that the kernel may speculatively execute unintended paths, leaking sensitive data from kernel memory to an attacker. The weakness is a control‑flow integrity defect (CWE‑201) that facilitates speculative information exposure.

Affected Systems

All Linux kernel implementations that enable the SRSO Safe-RET mitigation, regardless of distribution. The issue exists in kernels that have not applied the Safe‑RET patch referenced in the commit logs.

Risk and Exploitability

The CVSS score is 8.8 and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires a local attacker with privileged access to inject interrupts during the Safe‑RET execution window, a capability available in many elevated privilege contexts. The potential impact is high due to possible data leakage, though widespread exploitation has not yet been reported.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< dfefa3c51370f84acb643cddf98bb42c885d0483
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 52db77a13be224e09eb4ba6b4252ae8ab9085c2c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d0208e08d64d99383e09852a76cc3038c5a4c3ab
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e262f28a69ae9e0791248f93b0173c1d1f3e1d5d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< bfe7f9993467ba431b2731437949ac1e2634e771
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 61649a2d61cb0dbc673f0f232f0f0c298bf50442
`0`	affected	< 5.10.264
`0`	affected	< 5.15.215
`0`	affected	< 6.1.182
`0`	affected	< 6.6.150
`0`	affected	< 6.12.102
`0`	affected	< 6.18.43
`0`	affected	< 7.1.7

Linux

affected

Version	Status	Constraints
`5.10.264`	unaffected	≤ 5.10.*
`5.15.215`	unaffected	≤ 5.15.*
`6.1.182`	unaffected	≤ 6.1.*
`6.6.150`	unaffected	≤ 6.6.*
`6.12.102`	unaffected	≤ 6.12.*
`6.18.43`	unaffected	≤ 6.18.*
`7.1.7`	unaffected	≤ 7.1.*

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9de1a49e8f1fbf7c372902573a27a97d4ab4d0af)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9c0b8105e919be5208c81d5516a194a28c58fe1e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,95b08cdd603fe79d2e9d5212fbb13d577c835f4f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bfe7f9993467ba431b2731437949ac1e2634e771)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,61649a2d61cb0dbc673f0f232f0f0c298bf50442)`	affected	code_commit	—
`[0,5.10.263)`	affected	semver	—
`[0,5.15.214)`	affected	semver	—
`[0,6.1.181)`	affected	semver	—
`[0,6.6.149)`	affected	semver	—
`[0,6.18.43)`	affected	semver	—
`[0,7.1.7)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.263,5.10.*]`	unaffected	generic	—
`[5.15.214,5.15.*]`	unaffected	generic	—
`[6.1.181,6.1.*]`	unaffected	generic	—
`[6.6.149,6.6.*]`	unaffected	generic	—
`[6.18.43,6.18.*]`	unaffected	generic	—
`[7.1.7,7.1.*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that implements the Safe‑RET fix (see commit 608c8f5d…).
Reboot the system to load the updated kernel and restore the safe‑return mitigation.
If an immediate kernel update is not possible, restrict affected hosts to trusted environments, isolate from untrusted processes, and monitor for signs of speculative execution or interrupt injection attempts.

Generated by OpenCVE AI on August 7, 2026 at 01:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c
https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442
https://git.kernel.org/stable/c/6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096
https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771
https://git.kernel.org/stable/c/d0208e08d64d99383e09852a76cc3038c5a4c3ab
https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483
https://git.kernel.org/stable/c/e262f28a69ae9e0791248f93b0173c1d1f3e1d5d
https://nvd.nist.gov/vuln/detail/CVE-2026-68480
https://www.cve.org/CVERecord?id=CVE-2026-68480

History

Fri, 07 Aug 2026 06:45:00 +0000

Type	Values Removed	Values Added
References	https://git.kernel.org/stable/c/608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0 https://git.kernel.org/stable/c/95b08cdd603fe79d2e9d5212fbb13d577c835f4f https://git.kernel.org/stable/c/9c0b8105e919be5208c81d5516a194a28c58fe1e https://git.kernel.org/stable/c/9de1a49e8f1fbf7c372902573a27a97d4ab4d0af	https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c https://git.kernel.org/stable/c/6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096 https://git.kernel.org/stable/c/d0208e08d64d99383e09852a76cc3038c5a4c3ab https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483 https://git.kernel.org/stable/c/e262f28a69ae9e0791248f93b0173c1d1f3e1d5d

Fri, 07 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-201
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68480 https://www.cve.org/CVERecord?id=CVE-2026-68480
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}` threat_severity `Important`

Thu, 06 Aug 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return sequence, potentially leading to data leakage through speculative execution. Fixup register state as if the Safe-RET sequence executed successfully by "emulating" it, in a manner of speaking, and avoid executing a RET instruction after returning from the interrupt.
Title		x86/bugs: Make Safe-RET robust against interrupt injection
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0 https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442 https://git.kernel.org/stable/c/95b08cdd603fe79d2e9d5212fbb13d577c835f4f https://git.kernel.org/stable/c/9c0b8105e919be5208c81d5516a194a28c58fe1e https://git.kernel.org/stable/c/9de1a49e8f1fbf7c372902573a27a97d4ab4d0af https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-06T17:36:43.654Z

Updated: 2026-08-07T06:17:28.653Z

Reserved: 2026-07-30T09:28:09.397Z

Link: CVE-2026-68480

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-08-06T12:00:00Z

Links: CVE-2026-68480 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-07T01:45:05Z

Weaknesses

CWE-201
Insertion of Sensitive Information Into Sent Data

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object