CVE-2026-68176

What it actually does

NULL pointer dereference in the Linux kernel mmiotrace read path when mmio_pipe_open fails to locate a PCI device and leaves hiter->dev unset.

Why it matters to the business

Kernel instability or crashes on systems performing hardware-level tracing, potentially disrupting monitoring, debugging, or performance analysis workloads with minimal external exploit risk.

How an attack unfolds

An attacker with local access triggers mmio_pipe_open failure (for example by removing or hiding expected PCI devices) then performs a read on the mmiotrace pipe, causing the kernel to dereference the NULL dev pointer and panic.

How to fix it

Apply the upstream kernel commit that adds the additional hiter->dev NULL check before dereference; rebuild and deploy the patched kernel image.

How to confirm the fix worked

Inspect the mmiotrace read function for the combined NULL test on both hiter and hiter->dev; confirm the fix is present via kernel source or running a test that forces mmio_pipe_open failure.

Typical attack path

1. Obtain local access or ability to influence PCI device visibility
2. Cause mmio_pipe_open to fail finding the expected PCI device
3. Open and read from the mmiotrace pipe while hiter exists but hiter->dev is NULL
4. Trigger kernel NULL dereference and resulting panic or oops

How to detect it

Search kernel logs and dmesg for mmiotrace read paths ending in NULL pointer dereference or oops involving hiter; correlate with PCI device removal events before the crash.

• mmiotrace.*NULL pointer dereference
• hiter->dev
• mmio_pipe_open.*PCI device

What your security team should do

• Prioritize patching on systems that enable mmiotrace for hardware debugging
• Monitor kernel logs for mmiotrace-related NULL dereference oops until patched
• Restrict mmiotrace access to trusted users only