CVE-2026-68272

Received Received - Intake

NULL Pointer Dereference in AMDGPU Linux Kernel Driver

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and BO_HANDLES chunk types. The CP_GFX_SHADOW case previously shared a bare break with the dependency and syncobj chunk types, which do not dereference a fixed-size struct. When userspace submits this chunk with length_dw == 0, vmemdup_array_user() is called with size 0 and returns ZERO_SIZE_PTR, which passes the IS_ERR() check. amdgpu_cs_p2_shadow() then dereferences chunk->kdata as a struct drm_amdgpu_cs_chunk_cp_gfx_shadow (reading shadow->flags), faulting on the ZERO_SIZE_PTR and causing a NULL-pointer dereference. This is reachable by an unprivileged process in the render group. Reject undersized chunks with -EINVAL during pass1 so the bad submission is rejected before pass2 ever dereferences the data. (cherry picked from commit 7f61b2eef7415eccdb40850aca0de94211948657)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68272

EUVD

EUVD-2026-55373

Affected Vendors & Products

Vendor	Product	Version / Range
amd	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL-pointer dereference vulnerability in the Linux kernel's AMDGPU driver. It occurs when userspace submits a malformed CP_GFX_SHADOW chunk with zero length during the CS pass1 stage. The kernel fails to validate the chunk size properly, leading to a crash when it tries to access the zero-sized pointer as a struct.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMDGPU driver and is not network-reachable. Detection requires checking kernel logs for NULL-pointer dereference errors related to amdgpu_cs_pass1 or CP_GFX_SHADOW chunks. Monitor system logs with commands like 'dmesg | grep -i amdgpu' or 'journalctl -k | grep -i amdgpu'.

Impact Analysis

An unprivileged process in the render group could trigger a kernel crash by submitting a malicious GPU command. This could cause system instability, denial of service, or potential privilege escalation if combined with other exploits.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel vulnerability in the AMDGPU driver that could lead to a NULL-pointer dereference in the graphics subsystem, potentially causing system instability or crashes. Compliance impacts would only occur if this vulnerability were exploited to gain unauthorized access or disrupt services, which is not described here.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for CVE-2026-68272. If immediate patching is not possible, restrict access to the render group for unprivileged users as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-68272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70