CVE-2026-68188: Software Security Vulnerability Vulnerability

UNKNOWN

Advisory Identifier: GHSA-qrj4-v2pf-wj3g

Published 2026-08-10

Advisory Summary

CVE-2026-68188 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-68188 at a Glance

CVE Identifier CVE-2026-68188

GHSA Identifier GHSA-qrj4-v2pf-wj3g

Severity N/A

CVSS v3.1 Base Score N/A

CWE Classification General Security Weakness

Affected Product Software

Package Ecosystem Maven

Published Date 2026-08-10

Last Updated 2026-08-19

How to Fix CVE-2026-68188

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-68188, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in set_termios rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences both session->initiator and session->sock. Meanwhile, krfcommd can unlink the DLC and free the session while holding rfcomm_mutex. The race can proceed as follows: TTY ioctl task krfcommd -------------- -------- load dlc->session enter rfcomm_send_rpn() lock rfcomm_mutex clear dlc->session free session unlock rfcomm_mutex read session->initiator KASAN reported: BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0 Read of size 4 at addr ffff88810012a850 by task poc/92 Call Trace: rfcomm_send_rpn+0x297/0x2a0 rfcomm_tty_set_termios+0x50d/0x850 tty_set_termios+0x596/0x950 set_termios+0x46a/0x6e0 tty_mode_ioctl+0x152/0xbd0 tty_ioctl+0x915/0x1240 __x64_sys_ioctl+0x134/0x1c0 Allocated by task 92: rfcomm_session_add+0x9e/0x2e0 rfcomm_dlc_open+0x8b1/0xe00 rfcomm_dev_activate+0x85/0x1a0 rfcomm_tty_open+0x90/0x280 Freed by task 68: kfree+0x131/0x3c0 rfcomm_session_del+0x119/0x180 rfcomm_run+0x737/0x4710 Add rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies that the DLC is still attached and sends the RPN frame. Have the TTY path use the helper and drop its unlocked session check. This keeps the session valid through both the frame construction and socket send.

References

NVD — CVE-2026-68188 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-68188

git.kernel.org/stable/c/2894bd8c68... WEB

https://git.kernel.org/stable/c/2894bd8c68e97accd758ca6e5fc375d7e9e8882c

git.kernel.org/stable/c/4eac4576a0... WEB

https://git.kernel.org/stable/c/4eac4576a072084b06459de6c054b4ebc764b4ea

git.kernel.org/stable/c/780b04d09c... WEB

https://git.kernel.org/stable/c/780b04d09c941262ee2a2b4a09906451b69df8a6

git.kernel.org/stable/c/82c383f903... WEB

https://git.kernel.org/stable/c/82c383f9031f1ce919ac6c3c06bc5bd492a6b078

git.kernel.org/stable/c/98bc68194e... WEB

https://git.kernel.org/stable/c/98bc68194e37bfa5e8ddc80b5c1eb0be4dc607ea

git.kernel.org/stable/c/a82a9d3891... WEB

https://git.kernel.org/stable/c/a82a9d3891f5607030b0672c255087a12bb9837b

git.kernel.org/stable/c/c5c0605972... WEB

https://git.kernel.org/stable/c/c5c060597247131f90f39ea7c8c978fa0c2e79d0

git.kernel.org/stable/c/c783399efc... WEB

https://git.kernel.org/stable/c/c783399efc22d035443f1dfbf2a09bf9562aaa5e

Frequently Asked Questions

What is CVE-2026-68188?

CVE-2026-68188 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.

Which Software versions are affected?

Affected versions include releases prior to current release patches.

What version fixes CVE-2026-68188?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

What CWE is associated with CVE-2026-68188?

CVE-2026-68188 is classified under General Security Weakness.

How can I check Maven dependencies for CVE-2026-68188?

Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qrj4-v2pf-wj3g",
  "modified" : "2026-08-19T18:32:09Z",
  "published" : "2026-08-10T15:33:39Z",
  "aliases" : [ "CVE-2026-68188" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix session UAF in set_termios\n\nrfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and\nlater passes the pointer to rfcomm_send_rpn(). The latter dereferences\nboth session->initiator and session->sock. Meanwhile, krfcommd can\nunlink the DLC and free the session while holding rfcomm_mutex.\n\nThe race can proceed as follows:\n\n  TTY ioctl task                 krfcommd\n  --------------                 --------\n  load dlc->session\n  enter rfcomm_send_rpn()\n                                 lock rfcomm_mutex\n                                 clear dlc->session\n                                 free session\n                                 unlock rfcomm_mutex\n  read session->initiator\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0\n  Read of size 4 at addr ffff88810012a850 by task poc/92\n\n  Call Trace:\n   rfcomm_send_rpn+0x297/0x2a0\n   rfcomm_tty_set_termios+0x50d/0x850\n   tty_set_termios+0x596/0x950\n   set_termios+0x46a/0x6e0\n   tty_mode_ioctl+0x152/0xbd0\n   tty_ioctl+0x915/0x1240\n   __x64_sys_ioctl+0x134/0x1c0\n\n  Allocated by task 92:\n   rfcomm_session_add+0x9e/0x2e0\n   rfcomm_dlc_open+0x8b1/0xe00\n   rfcomm_dev_activate+0x85/0x1a0\n   rfcomm_tty_open+0x90/0x280\n\n  Freed by task 68:\n   kfree+0x131/0x3c0\n   rfcomm_session_del+0x119/0x180\n   rfcomm_run+0x737/0x4710\n\nAdd rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies\nthat the DLC is still attached and sends the RPN frame. Have the TTY\npath use the helper and drop its unlocked session check. This keeps the\nsession valid through both the frame construction and socket send.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68188"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2894bd8c68e97accd758ca6e5fc375d7e9e8882c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4eac4576a072084b06459de6c054b4ebc764b4ea"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/780b04d09c941262ee2a2b4a09906451b69df8a6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/82c383f9031f1ce919ac6c3c06bc5bd492a6b078"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/98bc68194e37bfa5e8ddc80b5c1eb0be4dc607ea"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a82a9d3891f5607030b0672c255087a12bb9837b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c5c060597247131f90f39ea7c8c978fa0c2e79d0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c783399efc22d035443f1dfbf2a09bf9562aaa5e"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-10T13:20:06Z"
  }
}

Advisory Metadata

Source ID: GHSA-qrj4-v2pf-wj3g
Schema Version: 1.4.0
Published: 2026-08-10 15:33
Last Modified: 2026-08-19 18:32
Database Record File: advisories/unreviewed/2026/08/GHSA-qrj4-v2pf-wj3g/GHSA-qrj4-v2pf-wj3g.json