CVE-2026-68115: Linux Kernel AMDGPU GFX10 Vulnerability

CVE-2026-68115 Overview

CVE-2026-68115 is a denial-of-service vulnerability in the Linux kernel's AMD GPU driver, specifically within the drm/amdgpu/gfx10 graphics component. The affected code paths used BUG_ON() assertions that trigger a full kernel panic when specific error conditions occur. The upstream fix replaces these BUG_ON() calls with WARN_ON() so the kernel logs a warning and continues execution rather than crashing. The change has been backported across multiple stable branches through several kernel commits.

Critical Impact
Error conditions in the AMD GFX10 graphics driver can trigger a kernel panic, halting the affected system and causing service disruption on workstations, servers, and cloud hosts that use AMD GPUs.

Affected Products

Linux kernel with the amdgpu DRM driver enabled
Systems using AMD GFX10-generation GPUs (Navi/RDNA family)
Distributions shipping kernels prior to the backported stable fixes referenced in the advisory

Discovery Timeline

2026-08-10 - CVE-2026-68115 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68115

Vulnerability Analysis

The vulnerability lives in the AMD GPU kernel driver code that handles GFX10 graphics initialization and runtime paths. The original code invoked BUG_ON() to enforce internal invariants. When a BUG_ON() condition evaluates true, the kernel treats it as an unrecoverable state and panics the host.

Because these particular checks describe conditions that do not require terminating the kernel, triggering them results in an avoidable denial-of-service outcome. Any user or workload that can drive the driver into the checked state can crash the machine. The maintainers replaced these assertions with WARN_ON(), which prints a stack trace and taints the kernel but allows execution to continue.

The EPSS score is 0.168% with a percentile of 6.422, reflecting a low predicted exploitation likelihood, consistent with a local availability issue rather than a remote code execution flaw.

Root Cause

The root cause is overuse of BUG_ON() for non-fatal error conditions in drivers/gpu/drm/amd/amdgpu/gfx_v10_* code. BUG_ON() unconditionally panics the kernel on failure, which is inappropriate for driver-level sanity checks that the surrounding code can otherwise tolerate or report through normal error propagation.

Attack Vector

The attack surface is local. A workload interacting with the AMD GPU through the DRM interface can reach the affected code paths in gfx10. When the invariant guarded by BUG_ON() fails, the kernel panics and the system becomes unavailable until reboot. No verified public proof-of-concept is available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is available. See the Linux Kernel Commit fixing the issue referenced in the advisory for technical details on the affected code path.

Detection Methods for CVE-2026-68115

Indicators of Compromise

Kernel panic messages referencing amdgpu and gfx_v10 functions in dmesg or serial console output
Unexpected host reboots on systems with AMD GFX10-class GPUs following graphics workloads
BUG: entries in /var/log/kern.log or journalctl -k correlated with GPU activity

Detection Strategies

Inventory Linux hosts running kernels that predate the fix commits listed in the advisory and correlate against installed AMD GPU hardware
Alert on kernel crash and panic events forwarded to a central logging pipeline, filtering for amdgpu module frames
Monitor for repeated host restarts on GPU-equipped nodes in virtualization and container hosts

Monitoring Recommendations

Forward kdump output and /var/crash contents to a centralized log store for retrospective analysis
Track kernel version drift across your fleet so unpatched hosts running the amdgpu driver are visible in dashboards
Correlate GPU workload telemetry with host availability metrics to identify hosts that reboot under specific graphics workloads

How to Mitigate CVE-2026-68115

Immediate Actions Required

Update to a Linux kernel version that includes one of the fix commits referenced in the advisory
Prioritize hosts with AMD GFX10 GPUs used for shared workloads, virtualization, or production graphics processing
Enable kdump so future kernel panics produce actionable crash data

Patch Information

The upstream fix replaces BUG_ON() with WARN_ON() in the AMD GFX10 driver. Backports are available in stable branches through the following commits:

Apply the distribution-provided kernel package that incorporates these commits and reboot to activate the new kernel.

Workarounds

Restrict local access on hosts with AMD GFX10 GPUs to trusted users until a patched kernel is deployed
Where GPU acceleration is not required, unload or blacklist the amdgpu module to remove the affected code from the running kernel
Enforce user session and workload isolation on multi-tenant hosts so a single crashed guest or workload does not affect neighboring services