CVE-2026-68260: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68260 Overview

CVE-2026-68260 is a null pointer dereference vulnerability in the Linux kernel's Imagination PowerVR Direct Rendering Manager (DRM) driver. The flaw resides in the GPU virtual memory (VM) subsystem, where the driver fails to acquire vm_ctx->lock before mapping memory to the GPU VM. Concurrent drm_gpuva_find*() and map/unmap operations trigger a NULL pointer dereference in kernel space.

A local user with access to the PowerVR device node can invoke the affected ioctl paths and crash the kernel. The bug affects systems running the PowerVR GPU driver on Linux, including embedded and RISC-V platforms where this driver is deployed.

Critical Impact
Local users can trigger a kernel-mode null pointer dereference through the PowerVR DRM ioctl interface, causing denial of service on affected Linux systems.

Affected Products

Linux kernel builds including the drm/imagination (PowerVR) GPU driver
Systems exposing the PowerVR DRM device node to unprivileged users
Embedded and RISC-V platforms using Imagination GPU hardware

Discovery Timeline

2026-08-10 - CVE-2026-68260 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68260

Vulnerability Analysis

The vulnerability exists in the drm/imagination (powervr) kernel module. The DRM gpuvm core does not internally serialize find operations against map operations. Each driver must ensure that a map operation cannot execute while a find operation is in progress on the same VM context.

The PowerVR driver's pvr_vm_map() did not acquire vm_ctx->lock before performing the mapping. When userspace concurrently issued DRM_IOCTL_PVR_VM_UNMAP (or a corresponding map ioctl), drm_gpuva_find() walked a partially updated tree and dereferenced a NULL pointer at address 0x10, resulting in a kernel oops.

The published crash trace shows the fault path: drm_gpuva_find+0x28 → pvr_vm_unmap+0x34 → pvr_ioctl_vm_unmap+0x2e → drm_ioctl_kernel → __riscv_sys_ioctl.

Root Cause

The root cause is missing lock acquisition in the PowerVR map path. All existing call sites of drm_gpuva_find*() are already protected by vm_ctx->lock, but pvr_vm_map() mutated the GPU VA tree without holding the same lock. This created a race window where a concurrent find operation observed inconsistent tree state and dereferenced a NULL node pointer.

Attack Vector

Exploitation requires local access and the ability to open the PowerVR DRM device node, typically /dev/dri/cardN or /dev/dri/renderDN. A local attacker issues concurrent VM map and unmap ioctl calls from multiple threads against the same DRM file descriptor to hit the race window. The result is a kernel NULL pointer dereference that crashes the system.

No synthetic proof-of-concept code is published. See the upstream commits linked in the kernel.org stable tree for the fix details.

Detection Methods for CVE-2026-68260

Indicators of Compromise

Kernel oops messages referencing drm_gpuva_find+0x28/0x6c [drm_gpuvm] in dmesg or /var/log/kern.log
Stack traces containing pvr_vm_unmap or pvr_ioctl_vm_unmap frames before a fault
Unexpected system crashes on hosts using the PowerVR GPU driver, often correlated with graphics or compute workloads

Detection Strategies

Enumerate loaded kernel modules and flag hosts where powervr and drm_gpuvm are present and the kernel version predates the fix commits.
Monitor kernel logs for Unable to handle kernel access to user memory faults at low virtual addresses originating from DRM ioctl paths.
Audit ioctl telemetry for high-frequency, concurrent calls against /dev/dri/* from a single unprivileged process.

Monitoring Recommendations

Collect and centralize kernel ring buffer output via journald or syslog forwarding for correlation across fleet endpoints.
Alert on repeated kernel panics or oops events on Linux hosts with Imagination GPU hardware.
Track patch state of the running kernel against distribution security advisories for the four upstream fix commits.

How to Mitigate CVE-2026-68260

Immediate Actions Required

Update the Linux kernel to a version that includes the PowerVR locking fix from the upstream stable tree.
Restrict access to /dev/dri/* device nodes to trusted users and groups, and remove the PowerVR driver from systems that do not require GPU acceleration.
Rebuild custom kernels with the referenced commits applied if a distribution package is not yet available.

Patch Information

The fix modifies pvr_vm_map() to acquire vm_ctx->lock before mapping memory to the GPU VM, matching the locking discipline used by all drm_gpuva_find*() callers. Upstream fix commits are published at 15f58d44, 17e2030f, 1f1f2618, and 6253bb56.

Workarounds

Unload the powervr module (modprobe -r powervr) on systems that do not need GPU functionality.
Tighten permissions on DRM device nodes via udev rules so that only members of the video or render group can open them.
Limit local user access on multi-tenant systems until the patched kernel is deployed.

bash

# Verify PowerVR driver status and remove if unused
lsmod | grep -E 'powervr|drm_gpuvm'
sudo modprobe -r powervr

# Restrict DRM device access via udev
echo 'SUBSYSTEM=="drm", KERNEL=="card*", MODE="0660", GROUP="video"' | \
  sudo tee /etc/udev/rules.d/60-drm-restrict.rules
sudo udevadm control --reload && sudo udevadm trigger