CVE-2026-68111 Overview
CVE-2026-68111 affects the Linux kernel's AMD GPU driver, specifically the drm/amdgpu/gfx9 module. The vulnerability stems from the use of BUG_ON() macros in code paths where a kernel panic is unnecessary. The fix replaces BUG_ON() calls with WARN_ON(), allowing the kernel to continue execution and log a warning rather than crash. This change was cherry-picked from upstream commit b71604f8685b.
Critical Impact
Triggering the affected code paths in the gfx9 driver could cause an unnecessary kernel panic, resulting in denial of service on systems using AMD GPUs.
Affected Products
- Linux kernel versions containing the drm/amdgpu/gfx9 driver prior to the patch
- Systems using AMD GPUs based on the GFX9 architecture (Vega, Raven Ridge, and related SoCs)
- Distributions shipping unpatched stable kernel branches
Discovery Timeline
- 2026-08-10 - CVE-2026-68111 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68111
Vulnerability Analysis
The issue resides in the AMD GPU kernel-mode driver, specifically the GFX9 IP block implementation. The driver used BUG_ON() assertions in code paths that did not warrant terminating kernel execution. When these assertions triggered, they caused a full kernel panic, halting the system. The upstream maintainers determined the failure modes covered by these assertions are recoverable and do not compromise kernel integrity.
The patch replaces the BUG_ON() invocations with WARN_ON() calls. WARN_ON() emits a stack trace and warning message to the kernel log without terminating execution, allowing the system to continue operating. This aligns with Linux kernel coding guidelines that reserve BUG_ON() for unrecoverable conditions.
Root Cause
The root cause is improper use of the BUG_ON() macro for conditions that are non-fatal. BUG_ON() unconditionally calls panic() in many configurations, and its use in driver code for recoverable states creates a denial-of-service condition when the checked condition evaluates true.
Attack Vector
The attack vector requires local access to hardware or software capable of reaching the affected gfx9 code paths. No public exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The condition maps to a kernel-level denial of service rather than privilege escalation or information disclosure.
The vulnerability is remediated in commits 042c047e8bc9, 43768ad42b8f, 6302be10b521, 6c8b9c1f03c7, and d74a6351d3f6. See the kernel.org stable tree for the fix details.
Detection Methods for CVE-2026-68111
Indicators of Compromise
- Unexpected kernel panics referencing amdgpu or gfx_v9 symbols in the stack trace
- Kernel log entries containing BUG: messages originating from drivers/gpu/drm/amd/amdgpu/gfx_v9
- System reboots or crashes correlated with AMD GPU workload initialization or shader compilation
Detection Strategies
- Query the running kernel version against distribution advisories referencing the stable commits listed above
- Review dmesg output and persistent kernel crash logs (/var/crash, kdump) for amdgpu panic signatures
- Inventory endpoints and servers running AMD GFX9-class GPUs to determine exposure scope
Monitoring Recommendations
- Forward kernel logs to a centralized log aggregation platform and alert on amdgpu panic patterns
- Track host uptime anomalies on AMD GPU-equipped workstations and compute nodes
- Correlate GPU driver crashes with user or workload activity to identify triggering conditions
How to Mitigate CVE-2026-68111
Immediate Actions Required
- Apply the stable kernel update from your Linux distribution that includes commits 042c047e8bc9, 43768ad42b8f, 6302be10b521, 6c8b9c1f03c7, or d74a6351d3f6
- Reboot affected systems into the patched kernel after installation
- Prioritize hosts running AMD GPU workloads such as workstations, GPU compute nodes, and gaming systems
Patch Information
The fix is available in the mainline Linux kernel and has been backported to stable trees. The relevant commits are hosted on git.kernel.org under the stable tree. Consult your distribution's security tracker for the specific kernel package version containing the fix.
Workarounds
- Where patching is not immediately feasible, avoid workloads that trigger the affected gfx9 code paths
- Enable kdump to capture crash information for triage if a panic occurs
- Consider disabling or blacklisting the amdgpu module on non-essential systems until the update is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
