CVE-2026-68187: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-gp6v-h5qc-h9v5
Share
Published
Advisory Summary

CVE-2026-68187 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-68187 at a Glance

CVE Identifier CVE-2026-68187
GHSA Identifier GHSA-gp6v-h5qc-h9v5
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-68187

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-68187, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transfer_args_to_stack() The stop value is derived from bprm->p >> PAGE_SHIFT. The index variable is an unsigned long. If bprm->p drops below PAGE_SIZE and stop becomes zero the loop condition index >= stop is always true. After the index == 0 iteration the decrement wraps to ULONG_MAX and bprm->page[ULONG_MAX] reads sizeof(void *) bytes in front of the array. The pointer has wrapped to -1. That garbage pointer is then passed to kmap_local_page() and PAGE_SIZE bytes are copied from wherever that lands into the stack of the process being created. And the loop doesn't terminate either... Getting there only requires bprm->p < PAGE_SIZE. On !MMU bprm_set_stack_limit() and bprm_hit_stack_limit() are empty. So the only constraint on how far bprm->p is pushed down is valid_arg_len(), i.e. that each individual string still fits in what is left. bprm->p starts at PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *) so a single argument or environment string of a little over 31 pages leaves it in the first page: Oops - load access fault [#1] CPU: 0 UID: 0 PID: 1 Comm: victim Not tainted 7.2.0-rc4 #1 epc : __memcpy+0xd4/0xf8 ra : transfer_args_to_stack+0xaa/0xae s4 : ffffffffffffffff s2 : 0000000000000000 a1 : ffffffdc98000000 a2 : 0000000000001000 status: 0000000a00001880 badaddr: ffffffdc98000000 cause: 0000000000000005 [<801a5324>] __memcpy+0xd4/0xf8 [<800d5f6a>] load_flat_binary+0x43a/0x65e [<800a2de4>] bprm_execve+0x1d4/0x316 [<800a351a>] do_execveat_common+0x12e/0x138 [<800a3d44>] __riscv_sys_execve+0x38/0x4e Kernel panic - not syncing: Fatal exception in interrupt This is an arcane bug but we should still fix it. Count down from MAX_ARG_PAGES so the loop ends when index reaches stop, stop == 0 included. The iterations performed are unchanged for every other value of stop. Only CONFIG_MMU=n builds are affected, transfer_args_to_stack() is used by binfmt_flat and binfmt_elf_fdpic on nommu only. The loop predates git history. commit 7e7ec6a93434 ("elf_fdpic_transfer_args_to_stack(): make it generic") only moved it from binfmt_elf_fdpic.c into fs/exec.c and narrowed the copy to the used part of the first page. The condition and the decrement are unchanged from 2.6.12-rc2.

References

NVD — CVE-2026-68187 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68187
git.kernel.org/stable/c/16cc4f5c1c... WEB
https://git.kernel.org/stable/c/16cc4f5c1c4b9e45eca7f7deefa5410a292db599
git.kernel.org/stable/c/2bc6bf70d4... WEB
https://git.kernel.org/stable/c/2bc6bf70d41055377f390d06f0f3521deb62fd3b
git.kernel.org/stable/c/55fa2c7f2b... WEB
https://git.kernel.org/stable/c/55fa2c7f2b15583d1a2fe1b5abcc24377359339f
git.kernel.org/stable/c/66e2094289... WEB
https://git.kernel.org/stable/c/66e20942890a383eb39b2009a2ceb4c2ebec37ef
git.kernel.org/stable/c/67cf5cdad8... WEB
https://git.kernel.org/stable/c/67cf5cdad823afb0530d6d0341fbf4ca07e93a09
git.kernel.org/stable/c/a9eb5c4949... WEB
https://git.kernel.org/stable/c/a9eb5c4949008034909bc34ecfa0843ecc1d0ab3
git.kernel.org/stable/c/c62bb00cab... WEB
https://git.kernel.org/stable/c/c62bb00caba66e01fb578d5f0302f247dc64930a
git.kernel.org/stable/c/dfc2a00742... WEB
https://git.kernel.org/stable/c/dfc2a00742af4cb7251c1a8fbce4fbae3cc0de4e

Frequently Asked Questions

What is CVE-2026-68187?
CVE-2026-68187 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-68187?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-68187?
CVE-2026-68187 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-68187?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gp6v-h5qc-h9v5",
  "modified" : "2026-08-19T18:32:09Z",
  "published" : "2026-08-10T15:33:40Z",
  "aliases" : [ "CVE-2026-68187" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: fix unsigned loop counter wrap in transfer_args_to_stack()\n\nThe stop value is derived from bprm->p >> PAGE_SHIFT. The index variable\nis an unsigned long. If bprm->p drops below PAGE_SIZE and stop becomes\nzero the loop condition index >= stop is always true.\n\nAfter the index == 0 iteration the decrement wraps to ULONG_MAX and\nbprm->page[ULONG_MAX] reads sizeof(void *) bytes in front of the array.\nThe pointer has wrapped to -1. That garbage pointer is then passed to\nkmap_local_page() and PAGE_SIZE bytes are copied from wherever that\nlands into the stack of the process being created. And the loop doesn't\nterminate either...\n\nGetting there only requires bprm->p < PAGE_SIZE. On !MMU\nbprm_set_stack_limit() and bprm_hit_stack_limit() are empty. So the only\nconstraint on how far bprm->p is pushed down is valid_arg_len(), i.e.\nthat each individual string still fits in what is left.\n\nbprm->p starts at PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *) so a\nsingle argument or environment string of a little over 31 pages leaves\nit in the first page:\n\n  Oops - load access fault [#1]\n  CPU: 0 UID: 0 PID: 1 Comm: victim Not tainted 7.2.0-rc4 #1\n  epc : __memcpy+0xd4/0xf8\n   ra : transfer_args_to_stack+0xaa/0xae\n   s4 : ffffffffffffffff   s2 : 0000000000000000\n   a1 : ffffffdc98000000   a2 : 0000000000001000\n  status: 0000000a00001880 badaddr: ffffffdc98000000 cause: 0000000000000005\n  [<801a5324>] __memcpy+0xd4/0xf8\n  [<800d5f6a>] load_flat_binary+0x43a/0x65e\n  [<800a2de4>] bprm_execve+0x1d4/0x316\n  [<800a351a>] do_execveat_common+0x12e/0x138\n  [<800a3d44>] __riscv_sys_execve+0x38/0x4e\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThis is an arcane bug but we should still fix it.\n\nCount down from MAX_ARG_PAGES so the loop ends when index reaches stop,\nstop == 0 included. The iterations performed are unchanged for every\nother value of stop.\n\nOnly CONFIG_MMU=n builds are affected, transfer_args_to_stack() is used\nby binfmt_flat and binfmt_elf_fdpic on nommu only.\n\nThe loop predates git history. commit 7e7ec6a93434\n(\"elf_fdpic_transfer_args_to_stack(): make it generic\") only moved it\nfrom binfmt_elf_fdpic.c into fs/exec.c and narrowed the copy to the used\npart of the first page. The condition and the decrement are unchanged\nfrom 2.6.12-rc2.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68187"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/16cc4f5c1c4b9e45eca7f7deefa5410a292db599"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2bc6bf70d41055377f390d06f0f3521deb62fd3b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/55fa2c7f2b15583d1a2fe1b5abcc24377359339f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/66e20942890a383eb39b2009a2ceb4c2ebec37ef"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/67cf5cdad823afb0530d6d0341fbf4ca07e93a09"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a9eb5c4949008034909bc34ecfa0843ecc1d0ab3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c62bb00caba66e01fb578d5f0302f247dc64930a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dfc2a00742af4cb7251c1a8fbce4fbae3cc0de4e"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-10T13:20:05Z"
  }
}