Vulnerability-Lookup

FKIE_CVE-2026-68427

Vulnerability from fkie_nvd - Published: 2026-08-10 13:20 - Updated: 2026-08-19 17:20

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/host1x/bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86a9bd8c8f422d5f3079da31e151868902fcc702",
              "status": "affected",
              "version": "af755456299d44e4ed6af3b7c70a7f03ea37fdf1",
              "versionType": "git"
            },
            {
              "lessThan": "abeff53233b984571b87582bb588b4b38ef4ea50",
              "status": "affected",
              "version": "71c017b3f83ff72638f2a1b1d6d4e7bc61d30231",
              "versionType": "git"
            },
            {
              "lessThan": "5b7e5f84d3d4cea10c3764d2da274810a7934228",
              "status": "affected",
              "version": "0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602",
              "versionType": "git"
            },
            {
              "lessThan": "5f4de3c717d34a24d555af581947742980778c02",
              "status": "affected",
              "version": "8c0d3cf0d5108c96317e0eca92b60dd368867cef",
              "versionType": "git"
            },
            {
              "lessThan": "b773faa32b0a98c3eb2b50d96de631681e5d1157",
              "status": "affected",
              "version": "df63c76f9c8d881ca7bce1aecfba512328d0527d",
              "versionType": "git"
            },
            {
              "lessThan": "266cddf7bd0f6c79b6c0633aef742a22bf70265b",
              "status": "affected",
              "version": "3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/host1x/bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.183",
              "status": "affected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.148",
              "status": "affected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.42",
              "status": "affected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.6",
              "status": "affected",
              "version": "7.1.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can\u0027t dereference mapping afterwards. The cache itself\noutlives the mapping, so use the cache local variable instead."
    }
  ],
  "id": "CVE-2026-68427",
  "lastModified": "2026-08-19T17:20:49.627",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-10T13:20:36.653",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-68427 (GCVE-0-2026-68427)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-19 16:35

Title

gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/86a9bd8c8f422d5f3…
https://git.kernel.org/stable/c/abeff53233b984571…
https://git.kernel.org/stable/c/5b7e5f84d3d4cea10…
https://git.kernel.org/stable/c/5f4de3c717d34a24d…
https://git.kernel.org/stable/c/b773faa32b0a98c3e…
https://git.kernel.org/stable/c/266cddf7bd0f6c79b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: af755456299d44e4ed6af3b7c70a7f03ea37fdf1 , < 86a9bd8c8f422d5f3079da31e151868902fcc702 (git) Affected: 71c017b3f83ff72638f2a1b1d6d4e7bc61d30231 , < abeff53233b984571b87582bb588b4b38ef4ea50 (git) Affected: 0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602 , < 5b7e5f84d3d4cea10c3764d2da274810a7934228 (git) Affected: 8c0d3cf0d5108c96317e0eca92b60dd368867cef , < 5f4de3c717d34a24d555af581947742980778c02 (git) Affected: df63c76f9c8d881ca7bce1aecfba512328d0527d , < b773faa32b0a98c3eb2b50d96de631681e5d1157 (git) Affected: 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc , < 266cddf7bd0f6c79b6c0633aef742a22bf70265b (git)
Linux	Linux	Affected: 6.1.178 , < 6.1.183 (semver) Affected: 6.6.145 , < 6.6.148 (semver) Affected: 6.12.97 , < 6.12.101 (semver) Affected: 6.18.40 , < 6.18.42 (semver) Affected: 7.1.5 , < 7.1.6 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/host1x/bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86a9bd8c8f422d5f3079da31e151868902fcc702",
              "status": "affected",
              "version": "af755456299d44e4ed6af3b7c70a7f03ea37fdf1",
              "versionType": "git"
            },
            {
              "lessThan": "abeff53233b984571b87582bb588b4b38ef4ea50",
              "status": "affected",
              "version": "71c017b3f83ff72638f2a1b1d6d4e7bc61d30231",
              "versionType": "git"
            },
            {
              "lessThan": "5b7e5f84d3d4cea10c3764d2da274810a7934228",
              "status": "affected",
              "version": "0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602",
              "versionType": "git"
            },
            {
              "lessThan": "5f4de3c717d34a24d555af581947742980778c02",
              "status": "affected",
              "version": "8c0d3cf0d5108c96317e0eca92b60dd368867cef",
              "versionType": "git"
            },
            {
              "lessThan": "b773faa32b0a98c3eb2b50d96de631681e5d1157",
              "status": "affected",
              "version": "df63c76f9c8d881ca7bce1aecfba512328d0527d",
              "versionType": "git"
            },
            {
              "lessThan": "266cddf7bd0f6c79b6c0633aef742a22bf70265b",
              "status": "affected",
              "version": "3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/host1x/bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.183",
              "status": "affected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.148",
              "status": "affected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.42",
              "status": "affected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.6",
              "status": "affected",
              "version": "7.1.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "6.1.178",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.6.145",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.12.97",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.18.40",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "7.1.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can\u0027t dereference mapping afterwards. The cache itself\noutlives the mapping, so use the cache local variable instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through the Tegra DRM/KMS device node (/dev/dri/card0): a local process pins a GEM buffer as a scanout framebuffer via an atomic commit and then destroys the handle, invoking tegra_bo_free_object() -\u003e host1x_bo_clear_cached_mappings(). No network or remote input reaches this code.\nAC:L - The use-after-free is unconditional and deterministic \u2014 every cached mapping freed by host1x_bo_clear_cached_mappings() is dereferenced again for the mutex_unlock. No race must be won and no special memory layout is needed; the attacker fully controls buffer creation, scanout pinning, and the destroy that triggers the free.\nPR:L - An unprivileged local user with access to the Tegra DRM device (video/graphics group, the logged-in console/compositor user on Android, automotive and embedded Tegra systems) can create GEM buffers, present them on a plane and free them. No root or CAP_SYS_ADMIN is required.\nUI:N - The attacking process performs the whole sequence itself \u2014 GEM allocation, atomic plane commit, and handle destruction \u2014 with no action by any other user or victim process.\nS:U - The corruption stays within the kernel\u0027s own memory and security authority; there is no crossing into another VM, IOMMU domain, or sandbox boundary.\nC:H - The freed host1x_bo_mapping is read after kfree() to obtain the cache pointer; with slab reuse the attacker can groom the freed object so the read returns attacker-influenced data, and the resulting UAF primitive can be leveraged to disclose kernel memory contents.\nI:H - mutex_unlock() writes to the lock word at the address read from freed memory, so a reallocated/poisoned mapping object yields a write through an attacker-influenceable pointer \u2014 a classic UAF write primitive usable for heap corruption and control-flow hijacking.\nA:H - Dereferencing the freed mapping reliably oopses under slab poisoning/KASAN, and unlocking a bogus mutex address corrupts kernel state, causing a panic or hang; the sequence can be repeated at will to keep the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:22.452Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702"
        },
        {
          "url": "https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02"
        },
        {
          "url": "https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157"
        },
        {
          "url": "https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b"
        }
      ],
      "title": "gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68427",
    "datePublished": "2026-08-10T12:04:47.915Z",
    "dateReserved": "2026-07-30T09:28:09.392Z",
    "dateUpdated": "2026-08-19T16:35:22.452Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-68427

CVE-2026-68427 (GCVE-0-2026-68427)

Tags

Sightings

Nomenclature