CVE-2026-68275: Linux Kernel Privilege Escalation Flaw

CVE-2026-68275 Overview

CVE-2026-68275 is a NULL pointer dereference vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu). The flaw resides in the AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl(), which calls amdgpu_vm_bo_find() and dereferences the returned pointer without validation. When a buffer object has no bo_va in the caller's virtual memory (VM), the function returns NULL, and subsequent list traversal triggers a kernel NULL pointer dereference. Any process with access to the render group can reach this code path by requesting mapping info for an unmapped buffer object.

Critical Impact
A local unprivileged user in the render group can trigger a kernel NULL pointer dereference through the amdgpu ioctl, causing a denial-of-service crash of the affected system.

Affected Products

Linux kernel builds including the drm/amdgpu driver prior to the fix
Distributions shipping the affected amdgpu_gem_op_ioctl() implementation
Systems with AMD GPU hardware exposing the render device node to userspace

Discovery Timeline

2026-08-10 - CVE-2026-68275 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68275

Vulnerability Analysis

The vulnerability exists in the AMDGPU_GEM_OP_GET_MAPPING_INFO handler within amdgpu_gem_op_ioctl(). The handler retrieves a bo_va structure for a given buffer object (BO) in the caller's VM by calling amdgpu_vm_bo_find(). The returned pointer is passed directly to amdgpu_vm_bo_va_for_each_valid_mapping() without a NULL check.

The macro expands to list_for_each_entry(mapping, &(bo_va)->valids, list), which dereferences bo_va to access the valids list head. When amdgpu_vm_bo_find() returns NULL, the kernel dereferences a NULL pointer, triggering an oops and crashing the affected context.

This is classified as a kernel-mode NULL pointer dereference [CWE-476] with denial-of-service impact. The fix returns -ENOENT when no bo_va is found and jumps to out_exec to properly release the drm_exec context and GEM object reference.

Root Cause

The root cause is missing return value validation. amdgpu_vm_bo_find() legitimately returns NULL for buffer objects that have never been mapped in the caller's VM. The GET_MAPPING_INFO code path treated this normal condition as an unreachable state and proceeded to dereference the returned pointer without a guard.

Attack Vector

Exploitation requires local access. Any process with permission to open the AMD GPU render device node, typically members of the render group, can issue the amdgpu_gem_op_ioctl() with AMDGPU_GEM_OP_GET_MAPPING_INFO against a newly allocated buffer object that has not been mapped. The ioctl call reaches the vulnerable code path and dereferences the NULL bo_va pointer, producing a kernel oops. No special privileges beyond render device access are required.

See the upstream fixes for technical details: Kernel Git Commit 93475c3, Kernel Git Commit 9faf4c6, and Kernel Git Commit ddba17b.

Detection Methods for CVE-2026-68275

Indicators of Compromise

Kernel oops or panic messages referencing amdgpu_gem_op_ioctl or amdgpu_vm_bo_va_for_each_valid_mapping in dmesg or /var/log/kern.log
Unexpected process terminations by user accounts belonging to the render group
Repeated ioctl calls to /dev/dri/renderD* with the AMDGPU_GEM_OP_GET_MAPPING_INFO opcode preceding a crash

Detection Strategies

Monitor kernel logs for NULL pointer dereference stack traces originating in the drm/amdgpu subsystem
Audit processes invoking amdgpu ioctls, correlating render-node access with subsequent kernel fault events
Compare installed kernel package versions against distribution advisories that reference the upstream fix commits

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on BUG: or Oops: entries containing amdgpu symbols
Track membership changes in the render and video groups on multi-user systems
Enable auditd rules on /dev/dri/renderD* device nodes to record unusual ioctl activity

How to Mitigate CVE-2026-68275

Immediate Actions Required

Apply the patched kernel from your Linux distribution once available, or rebuild from an upstream stable branch containing the fix commits
Inventory systems running AMD GPU hardware with the amdgpu driver loaded and prioritize multi-user workloads for patching
Restrict membership in the render group to trusted users on shared systems until the patch is deployed

Patch Information

The fix adds a NULL check on the return value of amdgpu_vm_bo_find() and returns -ENOENT with proper cleanup via the out_exec label. The upstream patches are available at Kernel Git Commit 93475c3, Kernel Git Commit 9faf4c6, and Kernel Git Commit ddba17b. The change is a cherry-pick of upstream commit 528b19377affc1cc7362a70a254c1dda793595f9.

Workarounds

Remove untrusted users from the render group to prevent access to /dev/dri/renderD* device nodes
Unload the amdgpu module on servers that do not require GPU acceleration using modprobe -r amdgpu
Apply mandatory access control policies (SELinux, AppArmor) to restrict which processes can open the render device

bash

# Verify running kernel and check for the fix
uname -r
# List users in the render group
getent group render
# Temporarily restrict access to the render device
chmod 0660 /dev/dri/renderD128