{
  "cveId": "CVE-2026-68090",
  "url": "https://patchblox.com/security/cve/CVE-2026-68090",
  "summary": "CVE-2026-68090 is fixed in 38 products on 1 platform, first by ALAS2023-2026-2045, released August 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "debugobjects: Plug race against a concurrent OOM disable",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  debugobjects: Plug race against a concurrent OOM disable  syzbot reported a puzzling splat:     WARNING: kernel/time/hrtimer.c:443 at stub_timer\u002B0xa/0x20  stub_timer() is installed as timer callback function in hrtimer_fixup_assert_init(), which is invoked when debug_object_assert_init() can\u0027t find a shadow object. In that case debug objects emits a warning about it before invoking the fixup.  Though the provided console log lacks this warning and instead has the following a few seconds before the splat:       ODEBUG: Out of memory. ODEBUG disabled  So the object was looked up in debug_object_assert_init() and the lookup failed due a concurrent out of memory situation which disabled debug objects and freed the shadow objects:  debug_object_assert_init()         if (!debug_objects_enabled)         \treturn;                         obj = alloc();                 \t\t\t\tif (!obj) { \t\t\t\t\t\t\t// Out of memory                                                 \tdebug_objects_enabled = false;                                                         free_objects();         obj = lookup_or_alloc();          // The lookup failed because the other side         // removed the objects, so this returns         // an error code as the object in question         // is not statically initialized  \tif (!IS_ERR_OR_NULL(obj))         \treturn;         if (!obj) {         \tdebug_oom();                 return;         }          print(...)            if (!debug_objects_enabled)                 return;          fixup(...)  The debug object splat is skipped because debug_objects_enabled is false, but the fixup callback is invoked unconditionally, which makes the timer disfunctional.  This is only a problem in debug_object_assert_init() and debug_object_activate() as both have to handle statically initialized objects and therefore must handle the error pointer return case gracefully. All other places only handle the found/not found case and the NULL pointer return is a signal for OOM. Otherwise they get a valid shadow object.  Plug the hole by checking whether debug objects are still enabled before invoking the print and fixup function in those two places.",
  "published": "2026-08-03T09:00:00Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "epss": 0.00177,
  "epssPercentile": 0.07268,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68090",
  "fixes": [
    {
      "platform": "linux",
      "product": "bpftool6.12",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bpftool6.12-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bpftool6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bpftool6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-6.12.100-125.179",
      "release": "amzn 2023",
      "fixedVersion": "1:1.0-0.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-6.18.39-79.141",
      "release": "amzn 2023",
      "fixedVersion": "1:1.0-0.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-debuginfo-common-aarch64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-debuginfo-common-x86_64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-headers",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-modules-extra",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-modules-extra-common",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-tools",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-tools-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.12-tools-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-debuginfo-common-aarch64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-debuginfo-common-x86_64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-headers",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-modules-extra",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-modules-extra-common",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-tools",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-tools-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-tools-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.180-1",
      "fix": "DEBIAN-CVE-2026-68090",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-68090",
      "released": "2026-08-11T16:03:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.96-1",
      "fix": "DEBIAN-CVE-2026-68090",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-68090",
      "released": "2026-08-11T16:03:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.4-1",
      "fix": "DEBIAN-CVE-2026-68090",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-68090",
      "released": "2026-08-11T16:03:09Z"
    },
    {
      "platform": "linux",
      "product": "microvm-kernel6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "perf6.12",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "perf6.12-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "perf6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "perf6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.12",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.12-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.12.100-125.179.amzn2023",
      "fix": "ALAS2023-2026-2057",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2057",
      "released": "2026-08-17T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.39-79.141.amzn2023",
      "fix": "ALAS2023-2026-2045",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2045",
      "released": "2026-08-03T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}