CVE-2026-68103

Received Received - Intake

AMDGPU Doorbell Mapping Race Condition in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using xa_store_irq() to store a doorbell, which allows a later queue created with the same BO and offset parameters to overwrite an existing queue and doorbell mapping. This can cause problems like misrouting fence IRQ processing to a wrong queue, and mislead the cleanup process of one queue erasing the mapping of another queue. This commit fixes this issue by replacing xa_store_irq with xa_insert_irq, which rejects mapping a reserved doorbell to a newly created queue (cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68103

EUVD

EUVD-2026-55484

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the AMD GPU driver where user space can create a queue with a doorbell BO handle and offset. The issue arises because the current implementation allows overwriting an existing queue and doorbell mapping if the same BO and offset are reused. This can lead to misrouting of fence IRQ processing and incorrect cleanup of queues.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMDGPU driver and requires kernel-level inspection. Detection involves checking kernel logs for AMDGPU-related errors or examining driver behavior during queue and doorbell operations. No standard network commands apply. Review kernel messages with 'dmesg | grep amdgpu' or check system logs for fence IRQ processing issues.

Impact Analysis

This vulnerability could cause system instability or crashes by misrouting interrupt processing and corrupting queue mappings. It may lead to incorrect cleanup of queues, potentially causing data corruption or denial of service in systems using AMD GPUs.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to doorbell mappings in AMD GPU drivers, which could lead to misrouting of fence IRQ processing and cleanup errors. No evidence suggests it impacts data protection or privacy compliance requirements.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this AMDGPU doorbell mapping issue. If immediate patching is not possible, restrict access to user-space queue creation or monitor for abnormal fence IRQ processing in AMDGPU components.

Hi! I’m here to help you understand CVE-2026-68103. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70