CVE-2026-68244 Overview
CVE-2026-68244 is a memory leak vulnerability in the Linux kernel's Intel i915 Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) subsystem. The flaw resides in the proto context creation path, specifically in the handling of user extensions. After a successful BALANCE or PARALLEL_SUBMIT extension, if a subsequent user extension fails during processing, the siblings[] array is not freed. The issue was discovered using AI-assisted static analysis and confirmed by Intel Product Security. The upstream fix was cherry-picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff.
Critical Impact
Repeated triggering of the error path by a local user can exhaust kernel memory, degrading system stability and enabling a local denial-of-service condition on affected Linux systems.
Affected Products
- Linux kernel — drm/i915/gem subsystem (Intel graphics driver)
- Stable kernel branches referenced by fix commits 37951ce1, 6cdbef8f, 8431a4d7, eed3de2a, and f014702f
- Systems using Intel integrated or discrete GPUs with the i915 driver loaded
Discovery Timeline
- 2026-08-10 - CVE-2026-68244 published to the National Vulnerability Database (NVD)
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68244
Vulnerability Analysis
The vulnerability is a kernel memory leak [CWE-401] in the Intel i915 GEM proto context creation path. When userspace creates a GEM context, it can attach a chain of user extensions to configure engine load balancing or parallel submission. The BALANCE and PARALLEL_SUBMIT extensions allocate a siblings[] array that lists the physical engines eligible for scheduling.
The extension processing loop applies extensions sequentially. If the BALANCE or PARALLEL_SUBMIT extension succeeds and populates the siblings[] array, but a subsequent extension in the same chain returns an error, the error unwind path does not release the previously allocated siblings[] memory. Each failed context creation attempt leaves an orphaned allocation in kernel space.
The EPSS score for this issue is low, reflecting a local, non-remote attack surface. However, an unprivileged local attacker with access to /dev/dri/card* can invoke the ioctl repeatedly to leak memory at scale.
Root Cause
The root cause is a missing free in the error-handling branch of the proto context extension processor. The allocation ownership is transferred to the proto context only on full success. Partial success followed by failure leaves the allocation orphaned because the cleanup routine does not walk previously initialized engines to release their sibling arrays.
Attack Vector
Exploitation requires local access to the DRM render node. An attacker crafts a DRM_IOCTL_I915_GEM_CONTEXT_CREATE_EXT call carrying a well-formed BALANCE or PARALLEL_SUBMIT extension followed by a malformed extension that triggers the error path. Repeating the ioctl in a loop steadily consumes non-swappable kernel memory. The vulnerability does not provide code execution or direct privilege escalation but produces a resource-exhaustion denial of service.
No verified public exploit code is available. Refer to the upstream fix commits for the exact code paths involved.
Detection Methods for CVE-2026-68244
Indicators of Compromise
- Sustained growth of unaccounted kernel slab memory correlated with a specific local process performing DRM ioctls
- Repeated DRM_IOCTL_I915_GEM_CONTEXT_CREATE_EXT calls returning -EINVAL or similar error codes from the same UID
- Progressive reduction in MemAvailable in /proc/meminfo without a corresponding userspace allocation
Detection Strategies
- Monitor per-process ioctl rates against /dev/dri/renderD* and /dev/dri/card* using auditd rules or eBPF tracepoints on drm_ioctl
- Track kernel slab caches associated with i915 context allocations through /proc/slabinfo for anomalous growth
- Correlate dmesg warnings from the i915 driver with userspace process telemetry to identify abusive callers
Monitoring Recommendations
- Baseline normal DRM ioctl volume per workstation class and alert on deviations from unprivileged users
- Instrument endpoint telemetry to capture kernel memory pressure events alongside process lineage
- Alert on OOM killer activations on graphics-enabled hosts where no legitimate GPU workload is scheduled
How to Mitigate CVE-2026-68244
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 37951ce1, 6cdbef8f, 8431a4d7, eed3de2a, and f014702f to all affected stable branches
- Track your distribution's security tracker for backported packages and schedule reboots after installation
- Restrict access to /dev/dri/* device nodes to trusted local users where GPU access is not required
Patch Information
The fix ensures the siblings[] array is released on the error unwind path when a later user extension fails. Refer to the upstream commits: Kernel Git Commit 37951c, Kernel Git Commit 6cdbef8, Kernel Git Commit 8431a4d, Kernel Git Commit eed3de2, and Kernel Git Commit f014702. The fix was cherry-picked from mainline commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff.
Workarounds
- Tighten permissions on DRM render nodes so only authorized users can issue GEM context ioctls
- Apply per-user memory cgroup limits to constrain the impact of kernel memory leaks originating from user sessions
- Where GPU acceleration is not required, blacklist the i915 module to remove the vulnerable code path entirely
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
