Vulnerability-Lookup

GHSA-HG58-RVXM-HMCV

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-14 00:31

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

drm_gpusvm_get_pages() only stored the local dpagemap into svm_pages->dpagemap on the success path. If a later page failed (e.g. -EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap, svm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped device_unmap() and leaked the device mappings already created.

Assign svm_pages->dpagemap when the first device page is mapped so the err_unmap path can device_unmap() those mappings.

This issue was found by Sashiko AI review.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-68240"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:12Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: publish dpagemap early to avoid device mapping leak on error\n\ndrm_gpusvm_get_pages() only stored the local dpagemap into\nsvm_pages-\u003edpagemap on the success path. If a later page failed (e.g.\n-EOPNOTSUPP when ctx-\u003eallow_mixed is false) and jumped to err_unmap,\nsvm_pages-\u003edpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped\ndevice_unmap() and leaked the device mappings already created.\n\nAssign svm_pages-\u003edpagemap when the first device page is mapped so the\nerr_unmap path can device_unmap() those mappings.\n\nThis issue was found by Sashiko AI review.",
  "id": "GHSA-hg58-rvxm-hmcv",
  "modified": "2026-08-14T00:31:53Z",
  "published": "2026-08-10T15:33:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68240"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/72e4fca5529e45b5beebad79d804de442f632324"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7f708f51e3955bda0d77a0b67ab9bea6c97fea99"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e8362523fd1b61712f7d996802f9b5dee545c7e6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-68240 (GCVE-0-2026-68240)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-17 05:01

Title

drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drm_gpusvm_get_pages() only stored the local dpagemap into svm_pages->dpagemap on the success path. If a later page failed (e.g. -EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap, svm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped device_unmap() and leaked the device mappings already created. Assign svm_pages->dpagemap when the first device page is mapped so the err_unmap path can device_unmap() those mappings. This issue was found by Sashiko AI review.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/e8362523fd1b61712…
https://git.kernel.org/stable/c/72e4fca5529e45b5b…
https://git.kernel.org/stable/c/7f708f51e3955bda0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 , < e8362523fd1b61712f7d996802f9b5dee545c7e6 (git) Affected: f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 , < 72e4fca5529e45b5beebad79d804de442f632324 (git) Affected: f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 , < 7f708f51e3955bda0d77a0b67ab9bea6c97fea99 (git)
Linux	Linux	Affected: 6.18 Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gpusvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e8362523fd1b61712f7d996802f9b5dee545c7e6",
              "status": "affected",
              "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9",
              "versionType": "git"
            },
            {
              "lessThan": "72e4fca5529e45b5beebad79d804de442f632324",
              "status": "affected",
              "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9",
              "versionType": "git"
            },
            {
              "lessThan": "7f708f51e3955bda0d77a0b67ab9bea6c97fea99",
              "status": "affected",
              "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gpusvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: publish dpagemap early to avoid device mapping leak on error\n\ndrm_gpusvm_get_pages() only stored the local dpagemap into\nsvm_pages-\u003edpagemap on the success path. If a later page failed (e.g.\n-EOPNOTSUPP when ctx-\u003eallow_mixed is false) and jumped to err_unmap,\nsvm_pages-\u003edpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped\ndevice_unmap() and leaked the device mappings already created.\n\nAssign svm_pages-\u003edpagemap when the first device page is mapped so the\nerr_unmap path can device_unmap() those mappings.\n\nThis issue was found by Sashiko AI review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local Intel Xe DRM render-node operations on /dev/dri/renderD* \u2014 DRM_XE_VM_CREATE in fault mode, VM_BIND of a CPU_ADDR_MIRROR range, madvise/prefetch to place pages in device VRAM, and a GPU exec that faults into __xe_svm_handle_pagefault(). No network or remote-peer input reaches drm_gpusvm_get_pages().\nAC:L - The attacker deterministically controls both preconditions: it chooses which pages of its own range live in device-private VRAM versus system memory, so the `!ctx-\u003eallow_mixed` / second-pagemap check fires at err_unmap after the first device page has already been device_map()\u0027d. No race, no memory-layout grooming, and __xe_svm_handle_pagefault() loops on `goto retry`, replaying the leak on demand.\nPR:L - Every ioctl on the path is DRM_RENDER_ALLOW; xe_vm_create_ioctl(), VM_BIND and exec perform no capable() or DRM-master check. Any unprivileged local user holding a render-node fd \u2014 the default for desktop seat users, render/video group members, containers and cloud GPU instances with /dev/dri passed through \u2014 can reach it.\nUI:N - The attacking process performs the entire sequence with its own ioctls, its own mappings and its own GPU submissions; the failing get_pages call is triggered by its own page fault. No action by another user or administrator is required.\nS:C - __drm_gpusvm_unmap_pages() is documented as the enforcement point of the GPU SVM IOMMU security model, and skipping device_unmap() leaves dma_map_resource() P2P translations programmed in the IOMMU after the range and its owning context are gone. The device keeps DMA reach into memory the DMA-isolation authority was supposed to withhold from it, crossing the IOMMU/DMA boundary.\nC:H - The leaked mappings are live IOMMU windows onto a peer GPU\u0027s VRAM BAR that outlive the SVM range and the process, so device memory subsequently reallocated to other DRM clients remains readable through the stale translation rather than being revoked at teardown, which is exactly what the missing device_unmap() was supposed to prevent.\nI:H - The leaked device mappings are created with dma_dir = DMA_BIDIRECTIONAL whenever the VMA is not read-only, so the stale window is device-writable as well as readable, leaving an attacker-influenced DMA write path into peer device memory that has since been handed to another context.\nA:H - Each failed get_pages leaks IOVA space and IOMMU page-table memory with no bound, and __xe_svm_handle_pagefault() re-enters `goto retry` while holding vm-\u003elock for write, so an unprivileged loop rapidly exhausts the device\u0027s IOVA/DMA resources and makes subsequent dma_map_resource()/dma_map_page() calls fail system-wide, hanging or wedging GPU clients on the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:29.579Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e8362523fd1b61712f7d996802f9b5dee545c7e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/72e4fca5529e45b5beebad79d804de442f632324"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f708f51e3955bda0d77a0b67ab9bea6c97fea99"
        }
      ],
      "title": "drm/gpusvm: publish dpagemap early to avoid device mapping leak on error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68240",
    "datePublished": "2026-08-10T12:01:05.810Z",
    "dateReserved": "2026-07-30T09:28:09.376Z",
    "dateUpdated": "2026-08-17T05:01:29.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-HG58-RVXM-HMCV

CVE-2026-68240 (GCVE-0-2026-68240)

Tags

Sightings

Nomenclature