Improper access control in Linux kernel - CVE-2026-68464
Published: August 17, 2026
Vulnerability identifier: #VU143611
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68464
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to improper access control in the sdhci-esdhc-imx suspend and resume interrupt handling logic when processing a WIFI out-of-band wakeup during a suspend and resume transition. A local attacker can trigger a crafted wakeup and card interrupt sequence to cause a denial of service.
The issue occurs when the usdhc interrupt remains enabled while the controller is still in runtime suspend state, leading to an unhandled interrupt warning.
Affected software
Linux kernel
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
How to mitigate CVE-2026-68464
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1