CVE-2026-68428: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-mw4f-xgh6-98v9
Share
Published
Advisory Summary

CVE-2026-68428 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-68428 at a Glance

CVE Identifier CVE-2026-68428
GHSA Identifier GHSA-mw4f-xgh6-98v9
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-68428

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-68428, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded. If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free. Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init(): 1. Load kvm.ko and kvm-intel.ko, creating both caches. 2. Unload only kvm_intel, leaving kvm.ko loaded. 3. Reload kvm_intel and force initialization through the -ENOMEM path. KASAN reports: BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... kmem_cache_destroy+0x21/0x1d0 kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... Allocated by task 16817: __kmem_cache_create_args+0x12c/0x3b0 __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm] kvm_mmu_vendor_module_init+0x13b/0x170 [kvm] ... Freed by task 16820: kmem_cache_destroy+0x117/0x1d0 kvm_mmu_vendor_module_exit+0x21/0x30 [kvm] Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe. With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.

References

NVD — CVE-2026-68428 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68428
git.kernel.org/stable/c/034b7fa1f5... WEB
https://git.kernel.org/stable/c/034b7fa1f5846d69eb51f12ce6d1c71871e83c2d
git.kernel.org/stable/c/32b9f89ed9... WEB
https://git.kernel.org/stable/c/32b9f89ed9e6d7a45075d64089c254a7f6e13695
git.kernel.org/stable/c/42272b0f23... WEB
https://git.kernel.org/stable/c/42272b0f239f3a89f9c26a01cc37aee06138b1b7
git.kernel.org/stable/c/43cfb20d62... WEB
https://git.kernel.org/stable/c/43cfb20d62ffe49626d62beecfc32eb6f262191c
git.kernel.org/stable/c/52f2f7c301... WEB
https://git.kernel.org/stable/c/52f2f7c30126037975389aa04d24c506a5177c35
git.kernel.org/stable/c/6f4be73880... WEB
https://git.kernel.org/stable/c/6f4be73880302d5642c83a0813fdfe1f5fd4b6e3
git.kernel.org/stable/c/940950d5cd... WEB
https://git.kernel.org/stable/c/940950d5cd86f250dca578279ad5ca63b4e0986b
git.kernel.org/stable/c/ec9daa8fd1... WEB
https://git.kernel.org/stable/c/ec9daa8fd1b6f45545c9839dca55bd867fad9e13

Frequently Asked Questions

What is CVE-2026-68428?
CVE-2026-68428 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-68428?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-68428?
CVE-2026-68428 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-68428?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mw4f-xgh6-98v9",
  "modified" : "2026-08-19T18:32:19Z",
  "published" : "2026-08-10T15:33:51Z",
  "aliases" : [ "CVE-2026-68428" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Fix use-after-free on vendor module reload\n\nmmu_destroy_caches() destroys pte_list_desc_cache and\nmmu_page_header_cache, but leaves both pointers unchanged.  The pointers\nlive in kvm.ko, and therefore survive when a vendor module is unloaded\nwhile kvm.ko remains loaded.\n\nIf creation of pte_list_desc_cache fails during a subsequent vendor\nmodule load, its assignment sets pte_list_desc_cache to NULL and the\nerror path calls mmu_destroy_caches().  mmu_page_header_cache still\npoints to the cache destroyed during the preceding vendor module\nunload.  Passing that stale pointer to kmem_cache_destroy() causes a\nslab use-after-free.\n\nReproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y,\nCONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m.  A\none-shot test hook forces pte_list_desc_cache to NULL on the second\ninvocation of kvm_mmu_vendor_module_init():\n\n  1. Load kvm.ko and kvm-intel.ko, creating both caches.\n  2. Unload only kvm_intel, leaving kvm.ko loaded.\n  3. Reload kvm_intel and force initialization through the -ENOMEM path.\n\nKASAN reports:\n\n  BUG: KASAN: slab-use-after-free in\n  kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]\n  ...\n  kmem_cache_destroy+0x21/0x1d0\n  kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]\n  ...\n  Allocated by task 16817:\n  __kmem_cache_create_args+0x12c/0x3b0\n  __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]\n  kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]\n  ...\n  Freed by task 16820:\n  kmem_cache_destroy+0x117/0x1d0\n  kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]\n\nClear both pointers immediately after destroying their caches so that\nthe stored state reflects the caches' lifetime and repeated cleanup is\nsafe.\n\nWith the fix applied, the same injected vendor module reload fails with\n-ENOMEM as expected and produces no KASAN report.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68428"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/034b7fa1f5846d69eb51f12ce6d1c71871e83c2d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/32b9f89ed9e6d7a45075d64089c254a7f6e13695"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/42272b0f239f3a89f9c26a01cc37aee06138b1b7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/43cfb20d62ffe49626d62beecfc32eb6f262191c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/52f2f7c30126037975389aa04d24c506a5177c35"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6f4be73880302d5642c83a0813fdfe1f5fd4b6e3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/940950d5cd86f250dca578279ad5ca63b4e0986b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ec9daa8fd1b6f45545c9839dca55bd867fad9e13"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-10T13:20:36Z"
  }
}