CVE-2026-68243: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68243 Overview

CVE-2026-68243 is a NULL pointer dereference vulnerability in the Linux kernel's Intel i915 Graphics Execution Manager (GEM) driver. The flaw resides in the handling of the I915_CONTEXT_PARAM_SSEU context parameter. When a userspace process sets a context engine slot to I915_ENGINE_CLASS_INVALID or I915_ENGINE_CLASS_INVALID_NONE and then applies I915_CONTEXT_PARAM_SSEU to the same slot, the kernel dereferences a NULL pointer. The issue was discovered using AI-assisted static analysis and confirmed by Intel Product Security. The fix has been merged and cherry-picked to stable kernel branches.

Critical Impact
A local unprivileged user with access to the i915 DRM device can trigger a kernel NULL pointer dereference resulting in a denial of service on affected Intel graphics systems.

Affected Products

Linux kernel with the drm/i915 GEM driver enabled
Systems using Intel integrated or discrete graphics with the i915 driver
Stable kernel branches prior to receiving the referenced backport commits

Discovery Timeline

2026-08-10 - CVE-2026-68243 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68243

Vulnerability Analysis

The vulnerability affects the drm/i915/gem subsystem, which manages GPU context state for Intel graphics hardware. Userspace applications configure per-context engine slots and can query or modify Slice/Sub-slice/EU (SSEU) power configuration through the I915_CONTEXT_PARAM_SSEU ioctl parameter. The driver assumes that any addressed engine slot references a valid engine object when the SSEU handler runs. That assumption breaks when the slot was previously reassigned to an invalid engine class.

Setting a slot to I915_ENGINE_CLASS_INVALID or I915_ENGINE_CLASS_INVALID_NONE clears the backing engine pointer for that slot. A subsequent I915_CONTEXT_PARAM_SSEU operation against the same slot then dereferences the NULL pointer inside kernel context, producing an oops. The result is a kernel crash on the affected CPU, potentially destabilizing the system for other users.

Root Cause

The root cause is a missing validation check [CWE-476] in the SSEU parameter path. The handler processes the target engine slot without verifying that the slot holds a valid engine reference after having been set to an invalid engine class. The upstream fix, cherry-picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87, adds the missing guard so that the SSEU code path rejects slots pointing to invalid engine classes rather than dereferencing NULL.

Attack Vector

Exploitation requires local access to the DRM render or card node exposed by the i915 driver, typically /dev/dri/renderD* or /dev/dri/card*. An attacker with the ability to open these device nodes can issue the required DRM_IOCTL_I915_GEM_CONTEXT_SETPARAM calls to reassign an engine slot to an invalid class and then invoke I915_CONTEXT_PARAM_SSEU against that slot. The vulnerability yields a denial of service outcome, not arbitrary code execution. See the kernel patch commit 2b56757 for the technical fix.

Detection Methods for CVE-2026-68243

Indicators of Compromise

Kernel oops or panic messages referencing i915, intel_context, or set_sseu in dmesg or /var/log/kern.log
Repeated segfaults or process crashes for graphics workloads running as unprivileged users
Unexpected GPU hangs or resets logged by the i915 driver following context parameter operations

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereference traces involving i915 GEM context handling functions.
Audit installed kernel versions against the fixed stable branches referenced in the upstream commits.
Track ioctl telemetry on /dev/dri/* device nodes where userspace analytics are available to detect unusual SETPARAM sequences.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on oops or BUG signatures tied to i915 symbols.
Correlate kernel crash events with the invoking user identity and process to identify potential local abuse.
Include the affected kernel package versions in vulnerability scanning baselines for Linux desktops, workstations, and virtualization hosts using Intel graphics.

How to Mitigate CVE-2026-68243

Immediate Actions Required

Apply the vendor-supplied kernel update that includes the backport of upstream commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87 for your distribution.
Reboot affected systems after the kernel package upgrade so the patched image loads.
Prioritize multi-user Linux systems, shared workstations, and VDI hosts where local users have DRM access.

Patch Information

The fix has been merged into the Linux stable tree across multiple branches. Distributions should ship kernel updates referencing one of the following commits: 2b56757, 726f27b, 97f2363, 9923c22, and edd2eda. Verify the running kernel version with uname -r and confirm the package changelog references CVE-2026-68243.

Workarounds

Restrict local access on shared systems so that only trusted users can open /dev/dri/* nodes, using group membership and access control lists.
Disable the i915 driver on systems that do not require Intel graphics acceleration by blacklisting the module via /etc/modprobe.d/.
Where feasible, prevent untrusted local users from executing graphics workloads until the patched kernel is deployed.

bash

# Verify kernel version and check for the fix
uname -r

# On Debian/Ubuntu, upgrade the kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-generic
sudo reboot

# On RHEL/Fedora based systems
sudo dnf update kernel
sudo reboot

# Optional: restrict DRM device access on multi-user systems
sudo chmod 0660 /dev/dri/renderD128
sudo chown root:video /dev/dri/renderD128