CVE-2026-68260
Received Received - Intake

Race Condition in PowerVR GPU VM Mapping in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is in progress. In some cases a find operation will be in progress when doing map/unmap operations, and the find operation will do a NULL pointer dereference. An example of the stack trace of such NULL dereference is shown below: ``` Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000000010 [<ffffffff01e989d4>] drm_gpuva_find+0x28/0x6c [drm_gpuvm] [<ffffffff01ed3a40>] pvr_vm_unmap+0x34/0x68 [powervr] [<ffffffff01ec69da>] pvr_ioctl_vm_unmap+0x2e/0x50 [powervr] [<ffffffff8080ce0a>] drm_ioctl_kernel+0x8e/0xdc [<ffffffff8080d016>] drm_ioctl+0x1be/0x3e0 [<ffffffff802bec3e>] __riscv_sys_ioctl+0xba/0xc4 [<ffffffff80d858b2>] do_trap_ecall_u+0x23e/0x3f4 [<ffffffff80d92288>] handle_exception+0x168/0x174 ``` As all occurences of drm_gpuva_find*() are already guarded by vm_ctx->lock, make pvr_vm_map() to acquire this lock to prevent disturbing any find operation. This fixes the NULL deference problem in drm_gpuva_find*().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68260
EUVD
EUVD-2026-55361

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the drm gpuvm code where a find operation can occur during map/unmap operations. This leads to a NULL pointer dereference in drm_gpuva_find, causing a kernel crash. The issue arises because the find operation is not protected against concurrent map operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/imagination GPU memory handling. Detection requires checking kernel logs for NULL pointer dereference errors in drm_gpuva_find or related GPU VM operations. Monitor logs with commands like 'dmesg | grep -i drm_gpuva_find' or 'journalctl -k | grep -i drm_gpuva_find'.

Impact Analysis

This vulnerability can cause system instability or crashes when specific GPU operations are performed. It may lead to denial-of-service conditions, requiring a system reboot to restore normal operation. Users running applications that use GPU acceleration could experience unexpected failures.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If immediate patching is not possible, restrict access to GPU-intensive applications or services until the update is applied. Monitor system stability and kernel logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68260. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart