CVE-2026-68242 Overview
CVE-2026-68242 is a NULL pointer dereference vulnerability in the Linux kernel's Intel i915 graphics driver. The flaw resides in the execlists_create_virtual() function within the drm/i915/gt subsystem. When allocation of sched_engine fails, the driver invokes intel_context_put() before intel_context_init() has completed. The internal kref_put() call then dereferences uninitialized state, causing a NULL pointer dereference on the IOCTL path. Intel Product Security confirmed the issue after it was surfaced through AI-assisted static analysis. The upstream fix was cherry-picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d.
Critical Impact
Local users invoking i915 IOCTLs during memory pressure can trigger a kernel NULL pointer dereference, resulting in a denial of service through kernel crash.
Affected Products
- Linux kernel — drm/i915/gt GPU driver subsystem
- Systems running Intel integrated or discrete graphics using the i915 driver
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Discovery Timeline
- 2026-08-10 - CVE-2026-68242 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68242
Vulnerability Analysis
The vulnerability exists in execlists_create_virtual(), a function in the Intel i915 GPU scheduling code that constructs virtual execution contexts. During context creation, the function must allocate a sched_engine structure. If that allocation fails, the error path releases the partially constructed intel_context reference. The original code invoked intel_context_put() before intel_context_init() had run, meaning the context's reference counter and destructor state were not yet valid. When kref_put() fires under this condition, it operates on uninitialized fields and dereferences a NULL pointer inside the kernel.
The defect is reachable through user-space IOCTL calls that request virtual engine contexts. An unprivileged local user can drive the code path by triggering the i915 IOCTL surface while the system is under memory pressure, increasing the probability that sched_engine allocation returns failure.
Root Cause
The root cause is an ordering error in object lifecycle management [CWE-476, CWE-665]. The cleanup routine assumed the context had been fully initialized, but the allocation failure occurred before intel_context_init() established the reference counting state. Calling intel_context_put() on an uninitialized object leads the reference release path to touch NULL fields.
Attack Vector
Exploitation requires local access and the ability to issue i915 DRM IOCTLs, which are available to unprivileged users on systems with rendering nodes. Triggering allocation failure requires memory pressure or fault injection. The outcome is a kernel oops or panic, producing a denial of service rather than code execution or privilege escalation.
No verified public exploit code exists for this issue. Technical details are available in the upstream kernel commits 82ec992c404c3dc774c5e9f3d4aa858e97187675 and edd4804f07b8369ed472de19272974e2bf2a6271.
Detection Methods for CVE-2026-68242
Indicators of Compromise
- Kernel oops or panic messages referencing execlists_create_virtual or intel_context_put in dmesg and system journals
- NULL pointer dereference traces originating from the drm/i915/gt subsystem
- Repeated crashes correlated with user-space processes invoking DRM IOCTLs under memory pressure
Detection Strategies
- Monitor kernel logs for BUG: unable to handle kernel NULL pointer dereference stack traces containing i915 GT symbols.
- Correlate crash events with the userland process, UID, and IOCTL activity to identify local triggers.
- Track kernel version and package inventory to identify hosts running vulnerable i915 code prior to the fix commits.
Monitoring Recommendations
- Forward /var/log/kern.log, journalctl -k, and kdump artifacts to a central log platform for pattern analysis.
- Alert on repeated i915 driver faults from the same non-root UID, which may indicate active abuse or fuzzing.
- Baseline expected DRM IOCTL volume so anomalous spikes on rendering nodes surface for review.
How to Mitigate CVE-2026-68242
Immediate Actions Required
- Identify Linux hosts running kernels that include the vulnerable execlists_create_virtual() ordering and prioritize patching.
- Apply the stable kernel update that incorporates commits 82ec992c404c3dc774c5e9f3d4aa858e97187675 and edd4804f07b8369ed472de19272974e2bf2a6271.
- Reboot affected systems after the kernel upgrade so the patched i915 module is loaded.
Patch Information
The fix reorders the error path in execlists_create_virtual() so intel_context_put() is only invoked after intel_context_init() has completed. The change was cherry-picked from upstream commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d. Distribution-specific patched kernels should be obtained from vendor advisories. See the kernel commit 82ec992c and kernel commit edd4804f for the authoritative patch content.
Workarounds
- Restrict access to DRM render nodes by tightening permissions on /dev/dri/renderD* where user rendering is not required.
- Reduce memory pressure conditions on affected hosts to lower the probability of sched_engine allocation failure.
- On servers that do not need graphics acceleration, blacklist the i915 module until the patched kernel is deployed.
# Verify running kernel and inspect for i915 faults
uname -r
dmesg | grep -Ei 'i915|execlists_create_virtual|NULL pointer'
# Optional: prevent i915 from loading on headless servers until patched
echo 'blacklist i915' | sudo tee /etc/modprobe.d/blacklist-i915.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
