CVE-2026-68090: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-qrrw-365j-cfxh
Share
Published
Advisory Summary

CVE-2026-68090 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-68090 at a Glance

CVE Identifier CVE-2026-68090
GHSA Identifier GHSA-qrrw-365j-cfxh
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-68090

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-68090, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20 stub_timer() is installed as timer callback function in hrtimer_fixup_assert_init(), which is invoked when debug_object_assert_init() can't find a shadow object. In that case debug objects emits a warning about it before invoking the fixup. Though the provided console log lacks this warning and instead has the following a few seconds before the splat: ODEBUG: Out of memory. ODEBUG disabled So the object was looked up in debug_object_assert_init() and the lookup failed due a concurrent out of memory situation which disabled debug objects and freed the shadow objects: debug_object_assert_init() if (!debug_objects_enabled) return; obj = alloc(); if (!obj) { // Out of memory debug_objects_enabled = false; free_objects(); obj = lookup_or_alloc(); // The lookup failed because the other side // removed the objects, so this returns // an error code as the object in question // is not statically initialized if (!IS_ERR_OR_NULL(obj)) return; if (!obj) { debug_oom(); return; } print(...) if (!debug_objects_enabled) return; fixup(...) The debug object splat is skipped because debug_objects_enabled is false, but the fixup callback is invoked unconditionally, which makes the timer disfunctional. This is only a problem in debug_object_assert_init() and debug_object_activate() as both have to handle statically initialized objects and therefore must handle the error pointer return case gracefully. All other places only handle the found/not found case and the NULL pointer return is a signal for OOM. Otherwise they get a valid shadow object. Plug the hole by checking whether debug objects are still enabled before invoking the print and fixup function in those two places.

References

NVD — CVE-2026-68090 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68090
git.kernel.org/stable/c/1f4f02b336... WEB
https://git.kernel.org/stable/c/1f4f02b336c3be125c8fcf87df73db2e0e028b8b
git.kernel.org/stable/c/203a965bf2... WEB
https://git.kernel.org/stable/c/203a965bf2ab43130778d8214fb0c3c8c2d19cdf
git.kernel.org/stable/c/23da32e886... WEB
https://git.kernel.org/stable/c/23da32e88627e63e0864f59f4c63a2dc0ab851a3
git.kernel.org/stable/c/2d5e320b7a... WEB
https://git.kernel.org/stable/c/2d5e320b7ab9b25229ac4331541964a58b5e1d29
git.kernel.org/stable/c/b81dde13cc... WEB
https://git.kernel.org/stable/c/b81dde13cc163450dcb402dcc915ef13ba241e01
git.kernel.org/stable/c/c00164c9e7... WEB
https://git.kernel.org/stable/c/c00164c9e7fa6145886ad666806cb5347895de5c
git.kernel.org/stable/c/d663fbf28b... WEB
https://git.kernel.org/stable/c/d663fbf28b2eebe665bb9cf828d7d528e5a8707e
git.kernel.org/stable/c/e2e255d077... WEB
https://git.kernel.org/stable/c/e2e255d07723c330dded8e576ce28a8d23a692ce

Frequently Asked Questions

What is CVE-2026-68090?
CVE-2026-68090 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-68090?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-68090?
CVE-2026-68090 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-68090?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qrrw-365j-cfxh",
  "modified" : "2026-08-10T12:31:55Z",
  "published" : "2026-08-10T12:31:55Z",
  "aliases" : [ "CVE-2026-68090" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ndebugobjects: Plug race against a concurrent OOM disable\n\nsyzbot reported a puzzling splat:\n\n   WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20\n\nstub_timer() is installed as timer callback function in\nhrtimer_fixup_assert_init(), which is invoked when\ndebug_object_assert_init() can't find a shadow object. In that case debug\nobjects emits a warning about it before invoking the fixup.\n\nThough the provided console log lacks this warning and instead has the\nfollowing a few seconds before the splat:\n\n     ODEBUG: Out of memory. ODEBUG disabled\n\nSo the object was looked up in debug_object_assert_init() and the lookup\nfailed due a concurrent out of memory situation which disabled debug\nobjects and freed the shadow objects:\n\ndebug_object_assert_init()\n        if (!debug_objects_enabled)\n        \treturn;                         obj = alloc();\n                \t\t\t\tif (!obj) {\n\t\t\t\t\t\t\t// Out of memory\n                                                \tdebug_objects_enabled = false;\n                                                        free_objects();\n        obj = lookup_or_alloc();\n\n        // The lookup failed because the other side\n        // removed the objects, so this returns\n        // an error code as the object in question\n        // is not statically initialized\n\n\tif (!IS_ERR_OR_NULL(obj))\n        \treturn;\n        if (!obj) {\n        \tdebug_oom();\n                return;\n        }\n\n        print(...)\n           if (!debug_objects_enabled)\n                return;\n\n        fixup(...)\n\nThe debug object splat is skipped because debug_objects_enabled is false,\nbut the fixup callback is invoked unconditionally, which makes the timer\ndisfunctional.\n\nThis is only a problem in debug_object_assert_init() and\ndebug_object_activate() as both have to handle statically initialized\nobjects and therefore must handle the error pointer return case\ngracefully. All other places only handle the found/not found case and the\nNULL pointer return is a signal for OOM. Otherwise they get a valid shadow\nobject.\n\nPlug the hole by checking whether debug objects are still enabled before\ninvoking the print and fixup function in those two places.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68090"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1f4f02b336c3be125c8fcf87df73db2e0e028b8b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/203a965bf2ab43130778d8214fb0c3c8c2d19cdf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/23da32e88627e63e0864f59f4c63a2dc0ab851a3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2d5e320b7ab9b25229ac4331541964a58b5e1d29"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b81dde13cc163450dcb402dcc915ef13ba241e01"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c00164c9e7fa6145886ad666806cb5347895de5c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d663fbf28b2eebe665bb9cf828d7d528e5a8707e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e2e255d07723c330dded8e576ce28a8d23a692ce"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-10T12:17:21Z"
  }
}