CVE-2026-68144

What it actually does

Use-after-free in pep_get_sb() when pskb_may_pull() relocates skb data but stale pointer is still dereferenced, allowing invalid memory access in the Phonet PEP receive path.

Why it matters to the business

Kernel instability, crashes, or potential local privilege escalation on Linux systems handling Phonet traffic, increasing downtime and exposure to further attacks; low EPSS and no KEV reduces immediate widespread risk but still requires attention on affected kernels.

How an attack unfolds

Attacker sends specially crafted Phonet packets that reach pep_do_rcv and pipe_handler_do_rcv, triggering pep_get_sb() where pskb_may_pull() moves data and leaves a dangling pointer for subsequent read, causing slab UAF detectable under KASAN.

How to fix it

Apply the upstream fix that replaces direct pointer access with skb_header_pointer() after pskb_may_pull in pep_get_sb; rebuild and deploy updated kernel images across all affected Linux distributions.

How to confirm the fix worked

Confirm kernel source contains the skb_header_pointer refetch after pskb_may_pull in pep_get_sb; run KASAN-enabled reproducer to verify absence of slab-use-after-free reports; check kernel version against distribution security updates.

Typical attack path

1. Send malicious Phonet skb to phonet_rcv
2. Reach pep_do_rcv and pipe_handler_do_rcv
3. Call pep_get_sb which invokes pskb_may_pull
4. Deref stale header pointer after data relocation
5. Trigger UAF read leading to crash or exploitation

How to detect it

Search kernel logs and KASAN output for strings referencing pep_get_sb, pipe_handler_do_rcv, and slab-use-after-free; inspect crash dumps for the exact stack trace involving phonet_rcv and pskb_may_pull.

• BUG: KASAN: slab-use-after-free in pep_get_sb
• pep_get_sb+0x234/0x3b0
• pipe_handler_do_rcv+0x5f7/0xa10
• phonet_rcv+0x5b3/0x6c0

What your security team should do

• Prioritize kernel updates on systems exposing Phonet or running network stacks that may process such traffic
• Monitor for KASAN or slab corruption logs indicating this UAF pattern
• Limit Phonet protocol usage where feasible until patched
• Track EPSS trend for any increase in exploit likelihood