CVE-2026-68240 (GCVE-0-2026-68240)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-17 05:01
VLAI
Title
drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drm_gpusvm_get_pages() only stored the local dpagemap into svm_pages->dpagemap on the success path. If a later page failed (e.g. -EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap, svm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped device_unmap() and leaked the device mappings already created. Assign svm_pages->dpagemap when the first device page is mapped so the err_unmap path can device_unmap() those mappings. This issue was found by Sashiko AI review.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 , < e8362523fd1b61712f7d996802f9b5dee545c7e6 (git)
Affected: f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 , < 72e4fca5529e45b5beebad79d804de442f632324 (git)
Affected: f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 , < 7f708f51e3955bda0d77a0b67ab9bea6c97fea99 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gpusvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e8362523fd1b61712f7d996802f9b5dee545c7e6",
              "status": "affected",
              "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9",
              "versionType": "git"
            },
            {
              "lessThan": "72e4fca5529e45b5beebad79d804de442f632324",
              "status": "affected",
              "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9",
              "versionType": "git"
            },
            {
              "lessThan": "7f708f51e3955bda0d77a0b67ab9bea6c97fea99",
              "status": "affected",
              "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gpusvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: publish dpagemap early to avoid device mapping leak on error\n\ndrm_gpusvm_get_pages() only stored the local dpagemap into\nsvm_pages-\u003edpagemap on the success path. If a later page failed (e.g.\n-EOPNOTSUPP when ctx-\u003eallow_mixed is false) and jumped to err_unmap,\nsvm_pages-\u003edpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped\ndevice_unmap() and leaked the device mappings already created.\n\nAssign svm_pages-\u003edpagemap when the first device page is mapped so the\nerr_unmap path can device_unmap() those mappings.\n\nThis issue was found by Sashiko AI review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local Intel Xe DRM render-node operations on /dev/dri/renderD* \u2014 DRM_XE_VM_CREATE in fault mode, VM_BIND of a CPU_ADDR_MIRROR range, madvise/prefetch to place pages in device VRAM, and a GPU exec that faults into __xe_svm_handle_pagefault(). No network or remote-peer input reaches drm_gpusvm_get_pages().\nAC:L - The attacker deterministically controls both preconditions: it chooses which pages of its own range live in device-private VRAM versus system memory, so the `!ctx-\u003eallow_mixed` / second-pagemap check fires at err_unmap after the first device page has already been device_map()\u0027d. No race, no memory-layout grooming, and __xe_svm_handle_pagefault() loops on `goto retry`, replaying the leak on demand.\nPR:L - Every ioctl on the path is DRM_RENDER_ALLOW; xe_vm_create_ioctl(), VM_BIND and exec perform no capable() or DRM-master check. Any unprivileged local user holding a render-node fd \u2014 the default for desktop seat users, render/video group members, containers and cloud GPU instances with /dev/dri passed through \u2014 can reach it.\nUI:N - The attacking process performs the entire sequence with its own ioctls, its own mappings and its own GPU submissions; the failing get_pages call is triggered by its own page fault. No action by another user or administrator is required.\nS:C - __drm_gpusvm_unmap_pages() is documented as the enforcement point of the GPU SVM IOMMU security model, and skipping device_unmap() leaves dma_map_resource() P2P translations programmed in the IOMMU after the range and its owning context are gone. The device keeps DMA reach into memory the DMA-isolation authority was supposed to withhold from it, crossing the IOMMU/DMA boundary.\nC:H - The leaked mappings are live IOMMU windows onto a peer GPU\u0027s VRAM BAR that outlive the SVM range and the process, so device memory subsequently reallocated to other DRM clients remains readable through the stale translation rather than being revoked at teardown, which is exactly what the missing device_unmap() was supposed to prevent.\nI:H - The leaked device mappings are created with dma_dir = DMA_BIDIRECTIONAL whenever the VMA is not read-only, so the stale window is device-writable as well as readable, leaving an attacker-influenced DMA write path into peer device memory that has since been handed to another context.\nA:H - Each failed get_pages leaks IOVA space and IOMMU page-table memory with no bound, and __xe_svm_handle_pagefault() re-enters `goto retry` while holding vm-\u003elock for write, so an unprivileged loop rapidly exhausts the device\u0027s IOVA/DMA resources and makes subsequent dma_map_resource()/dma_map_page() calls fail system-wide, hanging or wedging GPU clients on the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:29.579Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e8362523fd1b61712f7d996802f9b5dee545c7e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/72e4fca5529e45b5beebad79d804de442f632324"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f708f51e3955bda0d77a0b67ab9bea6c97fea99"
        }
      ],
      "title": "drm/gpusvm: publish dpagemap early to avoid device mapping leak on error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68240",
    "datePublished": "2026-08-10T12:01:05.810Z",
    "dateReserved": "2026-07-30T09:28:09.376Z",
    "dateUpdated": "2026-08-17T05:01:29.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68240",
      "date": "2026-08-20",
      "epss": "0.00161",
      "percentile": "0.0585"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68240\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:12.393\",\"lastModified\":\"2026-08-17T05:18:26.290\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/gpusvm: publish dpagemap early to avoid device mapping leak on error\\n\\ndrm_gpusvm_get_pages() only stored the local dpagemap into\\nsvm_pages-\u003edpagemap on the success path. If a later page failed (e.g.\\n-EOPNOTSUPP when ctx-\u003eallow_mixed is false) and jumped to err_unmap,\\nsvm_pages-\u003edpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped\\ndevice_unmap() and leaked the device mappings already created.\\n\\nAssign svm_pages-\u003edpagemap when the first device page is mapped so the\\nerr_unmap path can device_unmap() those mappings.\\n\\nThis issue was found by Sashiko AI review.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/drm_gpusvm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9\",\"lessThan\":\"e8362523fd1b61712f7d996802f9b5dee545c7e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9\",\"lessThan\":\"72e4fca5529e45b5beebad79d804de442f632324\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9\",\"lessThan\":\"7f708f51e3955bda0d77a0b67ab9bea6c97fea99\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/drm_gpusvm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/72e4fca5529e45b5beebad79d804de442f632324\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7f708f51e3955bda0d77a0b67ab9bea6c97fea99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e8362523fd1b61712f7d996802f9b5dee545c7e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-13T23:21:53+00:00",
      "cve": "CVE-2026-68240",
      "id": "CVE-2026-68240",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "92",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68240.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.