CVE-2026-68260 (GCVE-0-2026-68260)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-17 05:01
VLAI
Title
drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is in progress. In some cases a find operation will be in progress when doing map/unmap operations, and the find operation will do a NULL pointer dereference. An example of the stack trace of such NULL dereference is shown below: ``` Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000000010 [<ffffffff01e989d4>] drm_gpuva_find+0x28/0x6c [drm_gpuvm] [<ffffffff01ed3a40>] pvr_vm_unmap+0x34/0x68 [powervr] [<ffffffff01ec69da>] pvr_ioctl_vm_unmap+0x2e/0x50 [powervr] [<ffffffff8080ce0a>] drm_ioctl_kernel+0x8e/0xdc [<ffffffff8080d016>] drm_ioctl+0x1be/0x3e0 [<ffffffff802bec3e>] __riscv_sys_ioctl+0xba/0xc4 [<ffffffff80d858b2>] do_trap_ecall_u+0x23e/0x3f4 [<ffffffff80d92288>] handle_exception+0x168/0x174 ``` As all occurences of drm_gpuva_find*() are already guarded by vm_ctx->lock, make pvr_vm_map() to acquire this lock to prevent disturbing any find operation. This fixes the NULL deference problem in drm_gpuva_find*().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ff5f643de0bf27874c4033cd57a0bd034b5c7d11 , < 1f1f2618e44b21a7d4eb30d3bbd7e015ffbbbadf (git)
Affected: ff5f643de0bf27874c4033cd57a0bd034b5c7d11 , < 6253bb56bb2ebdf317d8b599ce737a2510cc2e17 (git)
Affected: ff5f643de0bf27874c4033cd57a0bd034b5c7d11 , < 15f58d44c24477a6ebffa44ec05207b81cfa55d9 (git)
Affected: ff5f643de0bf27874c4033cd57a0bd034b5c7d11 , < 17e2030f37600994440f875dc410615d5c66ee6d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_vm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f1f2618e44b21a7d4eb30d3bbd7e015ffbbbadf",
              "status": "affected",
              "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
              "versionType": "git"
            },
            {
              "lessThan": "6253bb56bb2ebdf317d8b599ce737a2510cc2e17",
              "status": "affected",
              "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
              "versionType": "git"
            },
            {
              "lessThan": "15f58d44c24477a6ebffa44ec05207b81cfa55d9",
              "status": "affected",
              "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
              "versionType": "git"
            },
            {
              "lessThan": "17e2030f37600994440f875dc410615d5c66ee6d",
              "status": "affected",
              "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_vm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM\n\nThe drm gpuvm code doesn\u0027t protect find operation against map operation,\nand the driver needs to ensure a map operation shouldn\u0027t happen when a\nfind operation is in progress.\n\nIn some cases a find operation will be in progress when doing map/unmap\noperations, and the find operation will do a NULL pointer dereference.\n\nAn example of the stack trace of such NULL dereference is shown below:\n\n```\nUnable to handle kernel access to user memory without uaccess routines at\nvirtual address 0000000000000010\n\n[\u003cffffffff01e989d4\u003e] drm_gpuva_find+0x28/0x6c [drm_gpuvm]\n[\u003cffffffff01ed3a40\u003e] pvr_vm_unmap+0x34/0x68 [powervr]\n[\u003cffffffff01ec69da\u003e] pvr_ioctl_vm_unmap+0x2e/0x50 [powervr]\n[\u003cffffffff8080ce0a\u003e] drm_ioctl_kernel+0x8e/0xdc\n[\u003cffffffff8080d016\u003e] drm_ioctl+0x1be/0x3e0\n[\u003cffffffff802bec3e\u003e] __riscv_sys_ioctl+0xba/0xc4\n[\u003cffffffff80d858b2\u003e] do_trap_ecall_u+0x23e/0x3f4\n[\u003cffffffff80d92288\u003e] handle_exception+0x168/0x174\n```\n\nAs all occurences of drm_gpuva_find*() are already guarded by\nvm_ctx-\u003elock, make pvr_vm_map() to acquire this lock to prevent\ndisturbing any find operation. This fixes the NULL deference problem in\ndrm_gpuva_find*()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered through the DRM_IOCTL_PVR_VM_MAP/VM_UNMAP ioctls on the PowerVR render node (/dev/dri/renderD*), which requires local access to the device file; no network or physical path exists.\nAC:L - The attacker owns both sides of the race, issuing concurrent VM_MAP and VM_UNMAP ioctls from two threads on the same fd and vm_ctx handle, and can retry indefinitely with attacker-chosen mapping layouts that force split/remap (free) paths.\nPR:L - The ioctls are marked DRM_RENDER_ALLOW, so no DRM master, root, or capability is needed; any unprivileged process able to open the render node (world-accessible or graphics-group on Android/embedded PowerVR devices) can reach the code.\nUI:N - The attacker performs the entire sequence itself by opening the render node, creating a VM context and issuing concurrent map/unmap ioctls; no victim action is involved.\nS:U - The corruption stays within the kernel\u0027s own security authority on the affected host; no VM, IOMMU or sandbox boundary is crossed by the flaw itself.\nC:H - The unlocked map path frees drm_gpuva objects via pvr_vm_gpuva_remap()/pvr_vm_gpuva_unmap() while a concurrent find returns them, yielding a use-after-free whose reclaimed contents the attacker can groom to read kernel memory; racing MMU updates can also leave GPU page tables mapping unintended pages.\nI:H - The same use-after-free plus unsynchronized rb interval-tree insert/remove gives attacker-influenced writes through a freed/corrupted structure, and the racing pvr_mmu_map/unmap operations can corrupt GPU page tables, which is leveragable into arbitrary memory modification.\nA:H - The reported failure is an immediate kernel NULL pointer dereference in drm_gpuva_find(), and tree corruption or use-after-free reliably produces oopses, and the ioctl can be re-issued to crash the system at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:52.352Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f1f2618e44b21a7d4eb30d3bbd7e015ffbbbadf"
        },
        {
          "url": "https://git.kernel.org/stable/c/6253bb56bb2ebdf317d8b599ce737a2510cc2e17"
        },
        {
          "url": "https://git.kernel.org/stable/c/15f58d44c24477a6ebffa44ec05207b81cfa55d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/17e2030f37600994440f875dc410615d5c66ee6d"
        }
      ],
      "title": "drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68260",
    "datePublished": "2026-08-10T12:01:34.414Z",
    "dateReserved": "2026-07-30T09:28:09.378Z",
    "dateUpdated": "2026-08-17T05:01:52.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68260",
      "date": "2026-09-21",
      "epss": "0.00163",
      "percentile": "0.0596"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/imagination/pvr_vm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1f1f2618e44b21a7d4eb30d3bbd7e015ffbbbadf",
                    "status": "affected",
                    "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6253bb56bb2ebdf317d8b599ce737a2510cc2e17",
                    "status": "affected",
                    "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "15f58d44c24477a6ebffa44ec05207b81cfa55d9",
                    "status": "affected",
                    "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "17e2030f37600994440f875dc410615d5c66ee6d",
                    "status": "affected",
                    "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/imagination/pvr_vm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM\n\nThe drm gpuvm code doesn\u0027t protect find operation against map operation,\nand the driver needs to ensure a map operation shouldn\u0027t happen when a\nfind operation is in progress.\n\nIn some cases a find operation will be in progress when doing map/unmap\noperations, and the find operation will do a NULL pointer dereference.\n\nAn example of the stack trace of such NULL dereference is shown below:\n\n```\nUnable to handle kernel access to user memory without uaccess routines at\nvirtual address 0000000000000010\n\n[\u003cffffffff01e989d4\u003e] drm_gpuva_find+0x28/0x6c [drm_gpuvm]\n[\u003cffffffff01ed3a40\u003e] pvr_vm_unmap+0x34/0x68 [powervr]\n[\u003cffffffff01ec69da\u003e] pvr_ioctl_vm_unmap+0x2e/0x50 [powervr]\n[\u003cffffffff8080ce0a\u003e] drm_ioctl_kernel+0x8e/0xdc\n[\u003cffffffff8080d016\u003e] drm_ioctl+0x1be/0x3e0\n[\u003cffffffff802bec3e\u003e] __riscv_sys_ioctl+0xba/0xc4\n[\u003cffffffff80d858b2\u003e] do_trap_ecall_u+0x23e/0x3f4\n[\u003cffffffff80d92288\u003e] handle_exception+0x168/0x174\n```\n\nAs all occurences of drm_gpuva_find*() are already guarded by\nvm_ctx-\u003elock, make pvr_vm_map() to acquire this lock to prevent\ndisturbing any find operation. This fixes the NULL deference problem in\ndrm_gpuva_find*()."
          }
        ],
        "id": "CVE-2026-68260",
        "lastModified": "2026-08-17T05:18:28.340",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:14.720",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15f58d44c24477a6ebffa44ec05207b81cfa55d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/17e2030f37600994440f875dc410615d5c66ee6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1f1f2618e44b21a7d4eb30d3bbd7e015ffbbbadf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6253bb56bb2ebdf317d8b599ce737a2510cc2e17"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:20:10+00:00",
      "cve": "CVE-2026-68260",
      "id": "CVE-2026-68260",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68260.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:44:07Z",
      "cve": "CVE-2026-68260",
      "id": "CVE-2026-68260",
      "initial_release_date": "2026-08-14T17:15:09Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "354",
      "product_status:recommended": "83",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68260",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68260.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.