CVE-2026-68357

A flaw was found in the Linux kernel's watchdog subsystem. When a watchdog governor is unregistered, if it is also set as the default governor, the default governor is not properly cleared. This can lead to a Use-After-Free (UAF) condition where new or existing watchdog devices may inherit or be reassigned a dangling pointer. This vulnerability could result in system instability or a denial of service.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation is confined to local environments and primarily leads to a kernel crash or system denial of service. The issue requires specific administrative actions to deregister a watchdog pretimeout policy module that has been designated as system default. Under standard enterprise deployments, watchdog governors are rarely loaded and unloaded dynamically during normal operations, limiting the real-world attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.