CVE-2026-68102: Linux Kernel Privilege Escalation Flaw

CVE-2026-68102 Overview

CVE-2026-68102 is a resource management flaw in the Linux kernel's drm/amdgpu driver. The vulnerability occurs because amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver's fini routines. As a result, drm_dev_enter() in amdgpu_ttm_fini() always returns false, and iounmap(aper_base_kaddr) never executes during normal driver unload. This leaves an orphaned entry in the x86 Page Attribute Table (PAT) interval tree, producing a memory mapping leak.

Critical Impact
On connected_to_cpu hardware, reloading the driver triggers an ioremap conflict between write-back (WB) and write-combining (WC) mappings, causing IP discovery to fail with -2 and preventing GPU initialization.

Affected Products

Linux kernel drm/amdgpu graphics driver
Systems using AMD GPUs with connected_to_cpu hardware paths
Discrete AMD GPU (dGPU) configurations relying on aperture ioremap_cache() mappings

Discovery Timeline

2026-08-10 - CVE-2026-68102 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68102

Vulnerability Analysis

The defect resides in the amdgpu driver's teardown ordering. When amdgpu_pci_remove() runs, it invokes drm_dev_unplug() prior to the driver's fini routines. Any subsequent call to drm_dev_enter() returns false because the device is marked unplugged. Consequently, the unmap path inside amdgpu_ttm_fini() is skipped and iounmap(aper_base_kaddr) never executes on a normal unload. The x86 PAT interval tree retains an orphaned entry that references the previous aperture mapping.

On hardware that reports connected_to_cpu, the aperture is mapped write-back through ioremap_cache(). When the driver reloads, IP discovery attempts memremap(..., MEMREMAP_WC) over the same physical range. The residual WB entry conflicts with the requested WC attribute, producing an ioremap error and amdgpu: discovery failed: -2. The system loses GPU functionality until reboot.

Root Cause

The root cause is a lifecycle mismatch between DRM unplug semantics and manual ioremap/iounmap calls. Cleanup was gated by drm_dev_enter(), but unplug had already been signaled. The fix migrates the aperture mapping to devres-managed helpers so cleanup occurs at device_del() regardless of DRM enter state.

Attack Vector

This vulnerability is a resource leak reachable through normal driver unload and reload sequences. It requires local privileges to load or unload kernel modules. No remote exploitation vector is documented. Exploitation impact is limited to denial of GPU functionality and kernel memory attribute pollution in the PAT interval tree.

The vulnerability manifests during driver teardown. See the referenced Kernel Git Commit for the fix implementation details.

Detection Methods for CVE-2026-68102

Indicators of Compromise

Kernel log entries containing ioremap error for 0x..., requested 0x1, got 0x0 after amdgpu module reload.
Kernel log messages reporting amdgpu: discovery failed: -2 during driver initialization.
GPU devices failing to enumerate after an rmmod amdgpu and modprobe amdgpu cycle.

Detection Strategies

Monitor dmesg output for PAT conflict warnings following DRM driver reloads.
Correlate amdgpu module load and unload events with subsequent ioremap failures in kernel telemetry.
Track kernel version and patch state across Linux endpoints to identify unpatched hosts running vulnerable drm/amdgpu code paths.

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into a centralized logging platform for pattern matching on PAT and ioremap errors.
Alert on repeated discovery failed messages tied to AMD GPU devices in fleets running compute or virtualization workloads.
Baseline the frequency of DRM driver reloads to distinguish operational maintenance from anomalous unload activity.

How to Mitigate CVE-2026-68102

Immediate Actions Required

Apply the upstream Linux kernel patch that switches aperture mappings to devm_memremap() and devm_ioremap_wc() for the amdgpu driver.
Update to a stable kernel release that includes the cherry-picked commit d871e99879cb5fd1fa798b006b4888887e63a17a.
Reboot affected systems after patching to clear any orphaned PAT interval tree entries created before the fix was applied.

Patch Information

The fix replaces manual ioremap_cache() and iounmap() calls with devres-managed helpers. On the connected_to_cpu path the driver now uses devm_memremap(MEMREMAP_WB), which for IORESOURCE_SYSTEM_RAM ranges takes the try_ram_remap() shortcut and reuses the kernel direct map without allocating a new virtual address or PAT entry. On the dGPU path the driver uses devm_ioremap_wc(), which registers iounmap() as a devres action guaranteed to run at device_del(). The redundant iounmap(aper_base_kaddr) call in amdgpu_device_unmap_mmio() was removed. Patch commits are available in the stable kernel tree.

Workarounds

Avoid unloading and reloading the amdgpu kernel module on affected hosts; reboot instead to reinitialize GPU state cleanly.
Restrict access to module management commands so that only trusted administrators can invoke rmmod or modprobe on the amdgpu driver.
Where feasible, disable connected_to_cpu AMD GPU configurations that trigger the WB versus WC conflict until the kernel is patched.

bash

# Verify installed kernel includes the amdgpu aperture mapping fix
uname -r
git -C /usr/src/linux log --oneline | grep -i 'drm/amdgpu: fix aperture mapping leak'

# Restrict module load/unload to root and audit changes
chmod 700 /sbin/rmmod /sbin/modprobe
auditctl -w /sbin/modprobe -p x -k module_load
auditctl -w /sbin/rmmod -p x -k module_unload