Answer in brief
CVE-2026-68357 records a Unknown severity vulnerability in watchdog: pretimeout: Fix UAF in watchdog_unregister_governor(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=da0d12ff2b829a35e9921918e925d79497b82bef <2e47b91b9b4020fcc01def14d6b6556d66074cf4 || >=da0d12ff2b829a35e9921918e925d79497b82bef <0ca252720f0e38411cfec3431db9bb1aed0a412c || >=da0d12ff2b829a35e9921918e925d79497b82bef <7d1658b066de30f4b23afc14814d22416a971e6e || >=da0d12ff2b829a35e9921918e925d79497b82bef <7993d626983cc58fbde9607333cfd2d57725c197 || >=da0d12ff2b829a35e9921918e925d79497b82bef <7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661 | 2e47b91b9b4020fcc01def14d6b6556d66074cf4, 0ca252720f0e38411cfec3431db9bb1aed0a412c, 7d1658b066de30f4b23afc14814d22416a971e6e, 7993d626983cc58fbde9607333cfd2d57725c197, 7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661 |
| Linux/Linuxgeneric | 4.9 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If the governor being unregistered is currently set as `default_gov`, the `default_gov` is never cleared. This leads to 2 use-after-free issues: 1. New watchdog devices registered after this point will inherit the dangling `default_gov`. 2. Existing watchdog devices using the unregistered governor will have their `wdd->gov` reassigned to the dangling `default_gov`. Fix the UAF by clearing `default_gov` if it matches the governor being unregistered.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68357 records a Unknown severity vulnerability in watchdog: pretimeout: Fix UAF in watchdog_unregister_governor(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=da0d12ff2b829a35e9921918e925d79497b82bef <2e47b91b9b4020fcc01def14d6b6556d66074cf4 || >=da0d12ff2b829a35e9921918e925d79497b82bef <0ca252720f0e38411cfec3431db9bb1aed0a412c || >=da0d12ff2b829a35e9921918e925d79497b82bef <7d1658b066de30f4b23afc14814d22416a971e6e || >=da0d12ff2b829a35e9921918e925d79497b82bef <7993d626983cc58fbde9607333cfd2d57725c197 || >=da0d12ff2b829a35e9921918e925d79497b82bef <7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661 | 2e47b91b9b4020fcc01def14d6b6556d66074cf4, 0ca252720f0e38411cfec3431db9bb1aed0a412c, 7d1658b066de30f4b23afc14814d22416a971e6e, 7993d626983cc58fbde9607333cfd2d57725c197, 7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661 |
| Linux/Linuxgeneric | 4.9 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If the governor being unregistered is currently set as `default_gov`, the `default_gov` is never cleared. This leads to 2 use-after-free issues: 1. New watchdog devices registered after this point will inherit the dangling `default_gov`. 2. Existing watchdog devices using the unregistered governor will have their `wdd->gov` reassigned to the dangling `default_gov`. Fix the UAF by clearing `default_gov` if it matches the governor being unregistered.
Quoted source text, attributed separately from HOL analysis.