CVE-2026-68186: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-2h9p-pp39-9929
Share
Published
Advisory Summary

CVE-2026-68186 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-68186 at a Glance

CVE Identifier CVE-2026-68186
GHSA Identifier GHSA-2h9p-pp39-9929
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-68186

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-68186, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: set have_execfd only once the interpreter is opened load_misc_binary() raises bprm->have_execfd as soon as it sees the 'O' (or 'C') flag. This happens well before it opens the interpreter. If that open fails the flag stays set on the bprm. binfmt_misc is at the head of the format list so an interpreter open failure that returns -ENOEXEC lets the search fall through to a later format. This means it runs the matched binary directly having never staged an interpreter. So bprm->executable is NULL while have_execfd falsely claims a descriptor is present. Consequently, begin_new_exec() dereferences the missing executable: would_dump(bprm, bprm->executable); and NULL derefs. Had it not, the hand-off later in the same function would have failed anyway. FD_ADD(0, bprm->executable) rejects a NULL file with -ENOMEM. Both sites are past the point of no return so the exec cannot be unwound either way. This can be reached by unprivileged users as binfmt_misc can be mounted in user namespaces. So a user can register an 'O' entry whose interpreter lives on a FUSE mount, have the FUSE server fail the open with -ENOEXEC and execute a native ELF file that matches the entry. have_execfd only means anything alongside the executable it describes which is not set until the interpreter has been opened and staged. So lets raise it there, next to execfd_creds, which is already set at that point. An open failure now leaves it clear, so the fallback format derives credentials from the binary and emits no AT_EXECFD, as it would for any native exec. The argv rewrite load_misc_binary() performs before the open is still not undone. This means the binary sees the interpreter path in argv[0] and its own path in argv[1] but that predates this change and only became observable once the exec stopped faulting.

References

NVD — CVE-2026-68186 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68186
git.kernel.org/stable/c/0f19d54e25... WEB
https://git.kernel.org/stable/c/0f19d54e2524f0bf183b82f365ae4e49b4a2f788
git.kernel.org/stable/c/1cd4e9b796... WEB
https://git.kernel.org/stable/c/1cd4e9b7967dab48c9f79a00b06ffff7208c0993
git.kernel.org/stable/c/2dd0298905... WEB
https://git.kernel.org/stable/c/2dd0298905e97795a9c5ec30cf5b41975f821632
git.kernel.org/stable/c/40c09b7a1d... WEB
https://git.kernel.org/stable/c/40c09b7a1d4e0a4866042c87c2bd911bb57566c8
git.kernel.org/stable/c/5ccc99d58f... WEB
https://git.kernel.org/stable/c/5ccc99d58f94fad258c9c375715b3974e48620e8
git.kernel.org/stable/c/a261dc49d9... WEB
https://git.kernel.org/stable/c/a261dc49d99681c9c71f38d16e31812dc3e30412
git.kernel.org/stable/c/a8e9e9450d... WEB
https://git.kernel.org/stable/c/a8e9e9450df44e9dd529ec5beff283f48f4f4b97
git.kernel.org/stable/c/bbf5f63991... WEB
https://git.kernel.org/stable/c/bbf5f639918dc011aaf60aab8480218758ee68c5

Frequently Asked Questions

What is CVE-2026-68186?
CVE-2026-68186 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-68186?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-68186?
CVE-2026-68186 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-68186?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2h9p-pp39-9929",
  "modified" : "2026-08-19T18:32:09Z",
  "published" : "2026-08-10T15:33:39Z",
  "aliases" : [ "CVE-2026-68186" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: set have_execfd only once the interpreter is opened\n\nload_misc_binary() raises bprm->have_execfd as soon as it sees the 'O'\n(or 'C') flag. This happens well before it opens the interpreter. If\nthat open fails the flag stays set on the bprm. binfmt_misc is at the\nhead of the format list so an interpreter open failure that returns\n-ENOEXEC lets the search fall through to a later format. This means it\nruns the matched binary directly having never staged an interpreter. So\nbprm->executable is NULL while have_execfd falsely claims a descriptor\nis present.\n\nConsequently, begin_new_exec() dereferences the missing executable:\n\n  would_dump(bprm, bprm->executable);\n\nand NULL derefs. Had it not, the hand-off later in the same function\nwould have failed anyway. FD_ADD(0, bprm->executable) rejects a NULL\nfile with -ENOMEM. Both sites are past the point of no return so the\nexec cannot be unwound either way.\n\nThis can be reached by unprivileged users as binfmt_misc can be mounted\nin user namespaces. So a user can register an 'O' entry whose\ninterpreter lives on a FUSE mount, have the FUSE server fail the open\nwith -ENOEXEC and execute a native ELF file that matches the entry.\n\nhave_execfd only means anything alongside the executable it describes\nwhich is not set until the interpreter has been opened and staged.\nSo lets raise it there, next to execfd_creds, which is already set at\nthat point. An open failure now leaves it clear, so the fallback format\nderives credentials from the binary and emits no AT_EXECFD, as it would\nfor any native exec. The argv rewrite load_misc_binary() performs before\nthe open is still not undone. This means the binary sees the interpreter\npath in argv[0] and its own path in argv[1] but that predates this\nchange and only became observable once the exec stopped faulting.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68186"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0f19d54e2524f0bf183b82f365ae4e49b4a2f788"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1cd4e9b7967dab48c9f79a00b06ffff7208c0993"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2dd0298905e97795a9c5ec30cf5b41975f821632"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/40c09b7a1d4e0a4866042c87c2bd911bb57566c8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5ccc99d58f94fad258c9c375715b3974e48620e8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a261dc49d99681c9c71f38d16e31812dc3e30412"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a8e9e9450df44e9dd529ec5beff283f48f4f4b97"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bbf5f639918dc011aaf60aab8480218758ee68c5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-10T13:20:05Z"
  }
}