Cloudanix VulnDB

CVE-2026-68166

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel lets attackers tamper with protected memory areas used for tracking function returns, potentially allowing them to run their own code instead.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits userfaultfd registration on VM_SHADOW_STACK and other VM_SPECIAL VMAs, allowing an attacker to discard pages and inject arbitrary content including chosen return addresses via UFFDIO_COPY.

Why it matters to the business

Attackers could gain unauthorized control over process execution flows on affected Linux systems, increasing risk of privilege escalation or system compromise, particularly in environments running unpatched Red Hat kernels where downstream dependents are widespread.

How an attack unfolds

An attacker with local access invokes userfaultfd to register on a shadow stack VMA, uses UFFDIO_COPY to replace pages with attacker-controlled return addresses, and leverages the resulting control to bypass stack protections and execute chosen code paths.

How to fix it

Upgrade Red Hat Enterprise Linux kernels to the fixed releases: el10 to 6.12.0-211.50.1.el10_2 or el9 to 5.14.0-687.44.1.el9_8 via the referenced RHSA.

How to confirm the fix worked

Confirm kernel version matches or exceeds the fixed releases listed for the distribution; verify vma_can_userfault rejects VM_SHADOW_STACK in source or runtime checks.

Typical attack path

  1. Obtain local execution context on a vulnerable kernel
  2. Call userfaultfd to register on a VM_SHADOW_STACK VMA
  3. Trigger page discard and UFFDIO_COPY to inject malicious return addresses
  4. Redirect execution to attacker-controlled code

How to detect it

Review system logs for unusual userfaultfd registrations or UFFDIO_COPY operations on processes with shadow stack mappings; correlate with process execution anomalies after kernel updates.

What your security team should do

  • Prioritize kernel upgrades on all Red Hat systems within the published remediation window
  • Monitor for new EPSS or KEV updates given the stable low exploit maturity
  • Restrict untrusted local code execution where possible until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY. Update vma_can_userfault() to reject VM_SHADOW_STACK. While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd. Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.

Affected packages

Ecosystem Package Introduced Fixed