CVE-2026-68275

Received Received - Intake

NULL Pointer Dereference in AMDGPU Kernel Driver

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO The AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl() looks up the bo_va for the buffer object in the caller's VM via amdgpu_vm_bo_find(), but uses the returned pointer without checking it. amdgpu_vm_bo_find() returns NULL when the BO has no bo_va in that VM, which is the normal case for a BO that has never been mapped. The result is fed straight into amdgpu_vm_bo_va_for_each_valid_mapping(), which expands to list_for_each_entry(mapping, &(bo_va)->valids, list) and dereferences bo_va, causing a NULL pointer dereference. This is reachable by any process able to issue the ioctl (render group) simply by requesting mapping info for an unmapped BO. Return -ENOENT when no bo_va is found, jumping to out_exec so the drm_exec context and GEM object reference are released. (cherry picked from commit 528b19377affc1cc7362a70a254c1dda793595f9)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68275

EUVD

EUVD-2026-55376

Affected Vendors & Products

Vendor	Product	Version / Range
amd	amdgpu	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's AMDGPU driver. It occurs when the amdgpu_vm_bo_find() function returns NULL for an unmapped buffer object, but the code proceeds to dereference this NULL pointer without checking. This leads to a crash when processing GET_MAPPING_INFO ioctl requests for unmapped buffers.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMDGPU driver and requires local system access to trigger. It cannot be detected remotely via network scans. Check kernel logs for NULL pointer dereference errors related to amdgpu or drm after running GPU-intensive applications.

Impact Analysis

An attacker with access to the render group could trigger this flaw to cause a kernel crash, resulting in a denial of service. It may also potentially allow privilege escalation if combined with other vulnerabilities, though this requires further exploitation steps.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel driver issue involving a NULL pointer dereference in AMDGPU functionality. Compliance impacts would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this CVE. If using a distribution kernel, apply available security patches immediately. Restrict access to the DRM subsystem by limiting render group permissions where possible.

Hi! I’m here to help you understand CVE-2026-68275. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70