CVE-2026-68480

Not scored yetLast modified Aug 18, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Make Safe-RET robust against interrupt injection

An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return sequence, potentially leading to data leakage through speculative execution.

Fixup register state as if the Safe-RET sequence executed successfully by "emulating" it, in a manner of speaking, and avoid executing a RET instruction after returning from the interrupt.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 6, 2026
Last modified
Aug 18, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-684817.5In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports CVE-2026-68482Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorizeCVE-2026-684849.0Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verifyCVE-2026-684879.9Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.CVE-2026-684889.9A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to rootCVE-2026-684898.7Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to executCVE-2026-68498.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software TechnoloCVE-2026-684908.2Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.CVE-2026-684919.4An insufficient check allowed for the overwrite of arbitrary files via a symlink.CVE-2026-684928.7An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated usersCVE-2026-684933.1After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they arCVE-2026-684948.7The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-block
CVE-2026-68480: Unscored | Vulnix