CVE-2026-68240 (GCVE-0-2026-68240)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-10-19 20:58
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drm_gpusvm_get_pages() only stored the local dpagemap into svm_pages->dpagemap on the success path. If a later page failed (e.g. -EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap, svm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped device_unmap() and leaked the device mappings already created. Assign svm_pages->dpagemap when the first device page is mapped so the err_unmap path can device_unmap() those mappings. This issue was found by Sashiko AI review.
References
Impacted products
Vendor Product Version
Linux Linux Version: f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9
Version: f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9
Version: f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68240",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:46:05.252837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:58:57.805Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gpusvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e8362523fd1b61712f7d996802f9b5dee545c7e6",
              "status": "affected",
              "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9",
              "versionType": "git"
            },
            {
              "lessThan": "72e4fca5529e45b5beebad79d804de442f632324",
              "status": "affected",
              "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9",
              "versionType": "git"
            },
            {
              "lessThan": "7f708f51e3955bda0d77a0b67ab9bea6c97fea99",
              "status": "affected",
              "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gpusvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: publish dpagemap early to avoid device mapping leak on error\n\ndrm_gpusvm_get_pages() only stored the local dpagemap into\nsvm_pages-\u003edpagemap on the success path. If a later page failed (e.g.\n-EOPNOTSUPP when ctx-\u003eallow_mixed is false) and jumped to err_unmap,\nsvm_pages-\u003edpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped\ndevice_unmap() and leaked the device mappings already created.\n\nAssign svm_pages-\u003edpagemap when the first device page is mapped so the\nerr_unmap path can device_unmap() those mappings.\n\nThis issue was found by Sashiko AI review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local Intel Xe DRM render-node operations on /dev/dri/renderD* \u2014 DRM_XE_VM_CREATE in fault mode, VM_BIND of a CPU_ADDR_MIRROR range, madvise/prefetch to place pages in device VRAM, and a GPU exec that faults into __xe_svm_handle_pagefault(). No network or remote-peer input reaches drm_gpusvm_get_pages().\nAC:L - The attacker deterministically controls both preconditions: it chooses which pages of its own range live in device-private VRAM versus system memory, so the `!ctx-\u003eallow_mixed` / second-pagemap check fires at err_unmap after the first device page has already been device_map()\u0027d. No race, no memory-layout grooming, and __xe_svm_handle_pagefault() loops on `goto retry`, replaying the leak on demand.\nPR:L - Every ioctl on the path is DRM_RENDER_ALLOW; xe_vm_create_ioctl(), VM_BIND and exec perform no capable() or DRM-master check. Any unprivileged local user holding a render-node fd \u2014 the default for desktop seat users, render/video group members, containers and cloud GPU instances with /dev/dri passed through \u2014 can reach it.\nUI:N - The attacking process performs the entire sequence with its own ioctls, its own mappings and its own GPU submissions; the failing get_pages call is triggered by its own page fault. No action by another user or administrator is required.\nS:C - __drm_gpusvm_unmap_pages() is documented as the enforcement point of the GPU SVM IOMMU security model, and skipping device_unmap() leaves dma_map_resource() P2P translations programmed in the IOMMU after the range and its owning context are gone. The device keeps DMA reach into memory the DMA-isolation authority was supposed to withhold from it, crossing the IOMMU/DMA boundary.\nC:H - The leaked mappings are live IOMMU windows onto a peer GPU\u0027s VRAM BAR that outlive the SVM range and the process, so device memory subsequently reallocated to other DRM clients remains readable through the stale translation rather than being revoked at teardown, which is exactly what the missing device_unmap() was supposed to prevent.\nI:H - The leaked device mappings are created with dma_dir = DMA_BIDIRECTIONAL whenever the VMA is not read-only, so the stale window is device-writable as well as readable, leaving an attacker-influenced DMA write path into peer device memory that has since been handed to another context.\nA:H - Each failed get_pages leaks IOVA space and IOMMU page-table memory with no bound, and __xe_svm_handle_pagefault() re-enters `goto retry` while holding vm-\u003elock for write, so an unprivileged loop rapidly exhausts the device\u0027s IOVA/DMA resources and makes subsequent dma_map_resource()/dma_map_page() calls fail system-wide, hanging or wedging GPU clients on the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:29.579Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e8362523fd1b61712f7d996802f9b5dee545c7e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/72e4fca5529e45b5beebad79d804de442f632324"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f708f51e3955bda0d77a0b67ab9bea6c97fea99"
        }
      ],
      "title": "drm/gpusvm: publish dpagemap early to avoid device mapping leak on error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68240",
    "datePublished": "2026-08-10T12:01:05.810Z",
    "dateReserved": "2026-07-30T09:28:09.376Z",
    "dateUpdated": "2026-10-19T20:58:57.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-68240\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:46:05.252837Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-401\", \"description\": \"CWE-401 Missing Release of Memory after Effective Lifetime\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:46:05.917Z\"}}], \"cna\": {\"title\": \"drm/gpusvm: publish dpagemap early to avoid device mapping leak on error\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only through local Intel Xe DRM render-node operations on /dev/dri/renderD* \\u2014 DRM_XE_VM_CREATE in fault mode, VM_BIND of a CPU_ADDR_MIRROR range, madvise/prefetch to place pages in device VRAM, and a GPU exec that faults into __xe_svm_handle_pagefault(). No network or remote-peer input reaches drm_gpusvm_get_pages().\\nAC:L - The attacker deterministically controls both preconditions: it chooses which pages of its own range live in device-private VRAM versus system memory, so the `!ctx-\u003eallow_mixed` / second-pagemap check fires at err_unmap after the first device page has already been device_map()\u0027d. No race, no memory-layout grooming, and __xe_svm_handle_pagefault() loops on `goto retry`, replaying the leak on demand.\\nPR:L - Every ioctl on the path is DRM_RENDER_ALLOW; xe_vm_create_ioctl(), VM_BIND and exec perform no capable() or DRM-master check. Any unprivileged local user holding a render-node fd \\u2014 the default for desktop seat users, render/video group members, containers and cloud GPU instances with /dev/dri passed through \\u2014 can reach it.\\nUI:N - The attacking process performs the entire sequence with its own ioctls, its own mappings and its own GPU submissions; the failing get_pages call is triggered by its own page fault. No action by another user or administrator is required.\\nS:C - __drm_gpusvm_unmap_pages() is documented as the enforcement point of the GPU SVM IOMMU security model, and skipping device_unmap() leaves dma_map_resource() P2P translations programmed in the IOMMU after the range and its owning context are gone. The device keeps DMA reach into memory the DMA-isolation authority was supposed to withhold from it, crossing the IOMMU/DMA boundary.\\nC:H - The leaked mappings are live IOMMU windows onto a peer GPU\u0027s VRAM BAR that outlive the SVM range and the process, so device memory subsequently reallocated to other DRM clients remains readable through the stale translation rather than being revoked at teardown, which is exactly what the missing device_unmap() was supposed to prevent.\\nI:H - The leaked device mappings are created with dma_dir = DMA_BIDIRECTIONAL whenever the VMA is not read-only, so the stale window is device-writable as well as readable, leaving an attacker-influenced DMA write path into peer device memory that has since been handed to another context.\\nA:H - Each failed get_pages leaks IOVA space and IOMMU page-table memory with no bound, and __xe_svm_handle_pagefault() re-enters `goto retry` while holding vm-\u003elock for write, so an unprivileged loop rapidly exhausts the device\u0027s IOVA/DMA resources and makes subsequent dma_map_resource()/dma_map_page() calls fail system-wide, hanging or wedging GPU clients on the machine.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9\", \"lessThan\": \"e8362523fd1b61712f7d996802f9b5dee545c7e6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9\", \"lessThan\": \"72e4fca5529e45b5beebad79d804de442f632324\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9\", \"lessThan\": \"7f708f51e3955bda0d77a0b67ab9bea6c97fea99\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/drm_gpusvm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.18.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.1.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.1.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/drm_gpusvm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e8362523fd1b61712f7d996802f9b5dee545c7e6\"}, {\"url\": \"https://git.kernel.org/stable/c/72e4fca5529e45b5beebad79d804de442f632324\"}, {\"url\": \"https://git.kernel.org/stable/c/7f708f51e3955bda0d77a0b67ab9bea6c97fea99\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/gpusvm: publish dpagemap early to avoid device mapping leak on error\\n\\ndrm_gpusvm_get_pages() only stored the local dpagemap into\\nsvm_pages-\u003edpagemap on the success path. If a later page failed (e.g.\\n-EOPNOTSUPP when ctx-\u003eallow_mixed is false) and jumped to err_unmap,\\nsvm_pages-\u003edpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped\\ndevice_unmap() and leaked the device mappings already created.\\n\\nAssign svm_pages-\u003edpagemap when the first device page is mapped so the\\nerr_unmap path can device_unmap() those mappings.\\n\\nThis issue was found by Sashiko AI review.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.44\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1.6\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2\", \"versionStartIncluding\": \"6.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-17T05:01:29.579Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-68240\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T20:58:57.805Z\", \"dateReserved\": \"2026-07-30T09:28:09.376Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-08-10T12:01:05.810Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.