CVE-2026-68113: Linux Kernel AMDGPU GFX12 Vulnerability

CVE-2026-68113 Overview

CVE-2026-68113 is a Linux kernel vulnerability in the AMD GPU driver's gfx12 component. Maintainers resolved the issue by replacing BUG_ON() calls with WARN_ON() in the drm/amdgpu/gfx12 code path. The original BUG_ON() calls could crash the kernel unnecessarily when triggered, causing a denial-of-service condition on systems using affected AMD graphics hardware. The fix was cherry-picked from upstream commit f952076f76d62f783e8ba4995a7c400d39354ccf and backported to stable kernel branches.

Critical Impact
Local conditions triggering the affected code path could crash the kernel, resulting in system-wide denial of service on hosts with AMD GPUs using the gfx12 driver.

Affected Products

Linux kernel versions containing the drm/amdgpu/gfx12 driver prior to the patch
Systems using AMD GPU hardware supported by the gfx12 driver
Stable kernel branches receiving the backported fix

Discovery Timeline

2026-08-10 - CVE-2026-68113 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68113

Vulnerability Analysis

The vulnerability resides in the AMD GPU direct rendering manager (DRM) driver, specifically in the gfx12 graphics engine support code. The affected code used BUG_ON() assertions to validate runtime conditions. When any of these assertions evaluated true, BUG_ON() triggered a kernel panic, halting the entire system.

Kernel maintainers determined the conditions checked did not warrant terminating the kernel. The fix replaces BUG_ON() with WARN_ON(), which logs the condition and continues execution. This aligns with kernel coding practices that reserve BUG_ON() for unrecoverable states only.

The issue represents a [CWE-617] Reachable Assertion pattern, where reachable runtime checks can be triggered to crash the kernel. Local users or workloads exercising the GPU driver code path could induce the panic without needing elevated privileges beyond normal graphics access.

Root Cause

The root cause is the improper use of BUG_ON() for conditions that are recoverable. BUG_ON() unconditionally invokes the kernel panic handler when its predicate is true. Using it in the gfx12 driver's control paths meant that any code path reaching a failing assertion took down the whole kernel rather than continuing with a warning.

Attack Vector

The attack vector requires local access to a system with an affected AMD GPU and the gfx12 driver loaded. A user process interacting with the GPU through standard DRM interfaces could reach the assertion condition. The result is a kernel panic and system reboot, disrupting availability for all users on the host.

The vulnerability does not provide code execution, privilege escalation, or information disclosure. Its impact is confined to denial of service. See the kernel patch commits for technical details on the affected code paths.

Detection Methods for CVE-2026-68113

Indicators of Compromise

Unexpected kernel panics referencing amdgpu or gfx12 symbols in the panic backtrace
System logs containing BUG_ON traces from the drivers/gpu/drm/amd/amdgpu/gfx_v12 code path prior to reboot
Repeated unplanned reboots on hosts with AMD GPU workloads

Detection Strategies

Query kernel version inventory against patched stable release tags to identify unpatched hosts
Review dmesg and journalctl -k output for amdgpu warnings and panics after GPU workloads run
Correlate host uptime anomalies with graphics workload scheduling on affected hardware

Monitoring Recommendations

Ship kernel logs to a centralized logging platform and alert on amdgpu panic signatures
Track host reboot events and correlate with kernel version and GPU driver activity
Monitor availability metrics for GPU-backed workloads such as compute nodes and workstations

How to Mitigate CVE-2026-68113

Immediate Actions Required

Identify all Linux hosts running AMD GPUs with the gfx12 driver loaded
Apply the stable kernel update containing the patch commits referenced by the NVD entry
Reboot affected systems after updating to activate the patched kernel

Patch Information

The fix is available in stable kernel branches through the following commits: 81597685c0d73b9c2e1a89c12c576ab80d1c00f4, 987bedd3ea89d747d1c5ab708ce3293e2f033b6c, cd3b3efa1ced05528d9128755338baa62a6b562d, and eef69b826b2036314b59020dfa6083fc859bfcc1. The change replaces BUG_ON() calls with WARN_ON() in the drm/amdgpu/gfx12 driver. Refer to the Linux stable tree for the applicable branches.

Workarounds

Restrict local access to systems with affected AMD GPUs until patching is complete
Avoid loading the amdgpu module on hosts that do not require GPU acceleration
Schedule GPU-intensive workloads on patched hosts only to reduce panic exposure

bash

# Verify current kernel version and check for amdgpu module
uname -r
lsmod | grep amdgpu

# After updating the kernel package, reboot to load the patched image
sudo reboot