CVE-2026-68232 Overview
CVE-2026-68232 is a memory management (MM) reference leak in the Linux kernel's Direct Rendering Manager (DRM) GPU Shared Virtual Memory (GPUSVM) subsystem. The flaw resides in the drm_gpusvm_range_evict() function. When kvmalloc_array() fails on the allocation path, the code does not release the MM reference acquired earlier in the function. Each failed eviction attempt leaks one reference to the target mm_struct, preventing correct teardown of process memory descriptors.
The issue was resolved through upstream Linux kernel commits that drop the MM reference on the kvmalloc_array() failure path.
Critical Impact
Repeated allocation failures during GPU SVM range eviction leak mm_struct references, which can prevent memory descriptor cleanup and contribute to resource exhaustion on affected Linux systems.
Affected Products
- Linux kernel versions containing the drm/gpusvm subsystem prior to the fixing commits
- Distributions shipping the vulnerable drm_gpusvm_range_evict() implementation
- Systems using GPU drivers that rely on DRM GPU Shared Virtual Memory
Discovery Timeline
- 2026-08-10 - CVE-2026-68232 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68232
Vulnerability Analysis
The vulnerability is a Memory Leak affecting the DRM GPUSVM component of the Linux kernel. GPUSVM enables GPUs to share virtual address space with CPU processes, which requires the kernel to hold references to the associated mm_struct during operations that touch process memory.
Inside drm_gpusvm_range_evict(), the function first acquires an MM reference to safely operate on the target process's memory mappings. It then calls kvmalloc_array() to allocate an array required to complete the eviction. If that allocation fails, the original code returns the error without calling the matching mmput() or equivalent release routine. The MM reference count therefore remains incremented for the lifetime of the process descriptor.
The EPSS score is 0.198%, reflecting a low probability of active exploitation. However, the defect still creates a reliability and resource-management concern on long-running systems that exercise GPUSVM eviction paths under memory pressure.
Root Cause
The root cause is missing cleanup on an error path. The function acquires a resource (an MM reference) before performing an allocation that can fail, and the failure branch omits the corresponding release call. This is a classic error-handling defect commonly categorized under improper resource release.
Attack Vector
The vulnerability requires local conditions that drive kvmalloc_array() to fail during GPUSVM range eviction. A local unprivileged user with access to a GPU device node exposing GPUSVM functionality could repeatedly trigger eviction paths under memory pressure to leak MM references. No remote attack vector is documented. See the Linux Kernel Commit 847b371, Linux Kernel Commit a2212fe, and Linux Kernel Commit adf0542 for the fix implementation.
Detection Methods for CVE-2026-68232
Indicators of Compromise
- Kernel log entries showing repeated kvmalloc_array() allocation failures inside DRM GPUSVM code paths
- Processes that have exited but whose mm_struct accounting remains elevated in /proc statistics
- Growing kernel slab usage for mm_struct allocations without a corresponding rise in active processes
Detection Strategies
- Compare the running kernel version and DRM subsystem commit hashes against the three upstream fix commits referenced by the CVE.
- Monitor kernel telemetry for allocation-failure warnings originating in drm_gpusvm_range_evict under memory pressure.
- Audit workloads that stress GPU SVM eviction, such as compute jobs using unified memory on supported GPUs.
Monitoring Recommendations
- Track slab statistics for mm_struct via /proc/slabinfo on hosts running GPU workloads.
- Alert on kernel oops, warnings, or WARN_ON events referencing gpusvm symbols.
- Baseline memory descriptor accounting on long-running GPU compute nodes to detect gradual reference growth.
How to Mitigate CVE-2026-68232
Immediate Actions Required
- Identify Linux hosts running kernels with the DRM GPUSVM subsystem enabled and GPU drivers that use it.
- Apply the upstream stable kernel updates that include the three referenced fix commits.
- Reboot affected systems after patching to ensure the corrected kernel image is active.
Patch Information
The fix drops the MM reference on the kvmalloc_array() failure path in drm_gpusvm_range_evict(). Upstream stable trees contain the correction in commits 847b371, a2212fe, and adf0542. Distribution vendors typically ship these fixes in stable kernel package updates.
Workarounds
- Restrict local access to GPU device nodes to trusted users where feasible, reducing exposure to eviction-path triggering.
- Avoid loading GPU drivers that enable the GPUSVM subsystem on systems where the feature is not required until patches are applied.
- Monitor and recycle long-running hosts exhibiting elevated mm_struct counts pending kernel updates.
# Verify installed kernel version and check for the fix
uname -r
# Example: apply distribution kernel updates
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)
# RHEL/CentOS/Fedora
sudo dnf update kernel
# Reboot to activate the patched kernel
sudo systemctl reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
