CVE-2026-68240: Linux Kernel Information Disclosure Flaw

CVE-2026-68240 Overview

CVE-2026-68240 is a Linux kernel vulnerability in the drm/gpusvm (Direct Rendering Manager GPU Shared Virtual Memory) subsystem. The flaw resides in drm_gpusvm_get_pages(), which only stored the local dpagemap into svm_pages->dpagemap on the success path. When a later page failed (for example, -EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap, svm_pages->dpagemap remained NULL. This caused __drm_gpusvm_unmap_pages() to skip device_unmap(), leaking device mappings already created. The issue was discovered through Sashiko AI review and resolved upstream.

Critical Impact
A local, low-privileged attacker can exploit the device mapping leak to compromise confidentiality, integrity, and availability across security boundaries on affected Linux kernel systems.

Affected Products

Linux kernel with the drm/gpusvm subsystem enabled
Distributions shipping unpatched kernel builds containing drm_gpusvm_get_pages()
GPU-enabled workloads relying on DRM shared virtual memory paths

Discovery Timeline

2026-08-10 - CVE-2026-68240 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68240

Vulnerability Analysis

The defect exists in the Linux kernel DRM GPU shared virtual memory (GPUSVM) code. drm_gpusvm_get_pages() iterates through pages and maps each one into device memory. The function assigns the local dpagemap pointer to svm_pages->dpagemap only after all pages successfully map. If a mid-loop failure occurs, control transfers to the err_unmap cleanup label before this assignment completes.

The cleanup helper __drm_gpusvm_unmap_pages() checks whether svm_pages->dpagemap is non-NULL before invoking device_unmap(). Because the assignment happened only on success, the cleanup path observed NULL and skipped device unmap operations. Device mappings already established for earlier pages persisted after the error return, producing a resource leak inside the kernel.

This leak affects kernel-managed device address space. Repeated triggering can exhaust device mapping resources and leave stale references that cross process or workload boundaries on shared GPU hardware.

Root Cause

The root cause is an ordering defect in error handling logic. State that the cleanup path depends on was published only after full success, violating the invariant required by the err_unmap unwind sequence. This is a resource management flaw in kernel driver code that produces a memory leak within the device mapping subsystem.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker triggers the failure path in drm_gpusvm_get_pages() by supplying page configurations that hit conditions such as -EOPNOTSUPP when ctx->allow_mixed is false. Repeatedly invoking the vulnerable code path leaks device mappings and can escalate impact across the changed scope indicated in the CVSS vector.

// No verified public exploit code is available.
// The fix reassigns svm_pages->dpagemap when the first device page
// is mapped so the err_unmap path can call device_unmap() correctly.
// See the upstream commits linked in the references for the patch diff.

Detection Methods for CVE-2026-68240

Indicators of Compromise

Unexpected growth in GPU device mapping counters or DRM subsystem memory usage over time on affected hosts
Kernel log entries showing repeated -EOPNOTSUPP returns from drm_gpusvm_get_pages() under normal workloads
Local processes issuing high volumes of DRM GPUSVM operations that fail partway through page mapping

Detection Strategies

Audit installed kernel versions against the fixed commits 72e4fca5529e, 7f708f51e395, and e8362523fd1b to identify unpatched hosts
Monitor for local user processes making unusual sequences of DRM ioctls targeting GPUSVM interfaces
Correlate GPU driver error rates with process identity to detect deliberate error-path exercise

Monitoring Recommendations

Track DRM subsystem memory accounting metrics and alert on sustained upward drift
Ingest dmesg and audit logs into a centralized store and query for drm_gpusvm error signatures
Baseline expected GPUSVM error rates per workload so anomalies surface quickly

How to Mitigate CVE-2026-68240

Immediate Actions Required

Apply the upstream kernel fix from Kernel Security Fix or the corresponding stable backports
Inventory hosts running GPU workloads and prioritize patching multi-tenant systems where local users share GPU hardware
Restrict local shell and container access on unpatched systems until updates are deployed

Patch Information

The fix assigns svm_pages->dpagemap when the first device page is mapped, so the err_unmap path can call device_unmap() on partially completed mappings. The change is available in the mainline commits Kernel Patch Update, Kernel Code Change, and Kernel Security Fix. Rebuild custom kernels or install vendor updates that include these commits.

Workarounds

Disable or unload the drm/gpusvm code path on systems that do not require GPU shared virtual memory features
Limit local access to GPU device nodes such as /dev/dri/* using standard Linux permissions and group membership
Constrain container workloads from directly accessing DRM device nodes when GPU passthrough is not required

bash

# Verify installed kernel version and confirm the fix is present
uname -r

# Restrict access to DRM device nodes to the video/render groups only
ls -l /dev/dri/

# Reload the kernel after applying vendor-supplied patched packages
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot