{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68240", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.376Z", "datePublished": "2026-08-10T12:01:05.810Z", "dateUpdated": "2026-08-17T05:01:29.579Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:01:29.579Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: publish dpagemap early to avoid device mapping leak on error\n\ndrm_gpusvm_get_pages() only stored the local dpagemap into\nsvm_pages->dpagemap on the success path. If a later page failed (e.g.\n-EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap,\nsvm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped\ndevice_unmap() and leaked the device mappings already created.\n\nAssign svm_pages->dpagemap when the first device page is mapped so the\nerr_unmap path can device_unmap() those mappings.\n\nThis issue was found by Sashiko AI review." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only through local Intel Xe DRM render-node operations on /dev/dri/renderD* — DRM_XE_VM_CREATE in fault mode, VM_BIND of a CPU_ADDR_MIRROR range, madvise/prefetch to place pages in device VRAM, and a GPU exec that faults into __xe_svm_handle_pagefault(). No network or remote-peer input reaches drm_gpusvm_get_pages().\nAC:L - The attacker deterministically controls both preconditions: it chooses which pages of its own range live in device-private VRAM versus system memory, so the `!ctx->allow_mixed` / second-pagemap check fires at err_unmap after the first device page has already been device_map()'d. No race, no memory-layout grooming, and __xe_svm_handle_pagefault() loops on `goto retry`, replaying the leak on demand.\nPR:L - Every ioctl on the path is DRM_RENDER_ALLOW; xe_vm_create_ioctl(), VM_BIND and exec perform no capable() or DRM-master check. Any unprivileged local user holding a render-node fd — the default for desktop seat users, render/video group members, containers and cloud GPU instances with /dev/dri passed through — can reach it.\nUI:N - The attacking process performs the entire sequence with its own ioctls, its own mappings and its own GPU submissions; the failing get_pages call is triggered by its own page fault. No action by another user or administrator is required.\nS:C - __drm_gpusvm_unmap_pages() is documented as the enforcement point of the GPU SVM IOMMU security model, and skipping device_unmap() leaves dma_map_resource() P2P translations programmed in the IOMMU after the range and its owning context are gone. The device keeps DMA reach into memory the DMA-isolation authority was supposed to withhold from it, crossing the IOMMU/DMA boundary.\nC:H - The leaked mappings are live IOMMU windows onto a peer GPU's VRAM BAR that outlive the SVM range and the process, so device memory subsequently reallocated to other DRM clients remains readable through the stale translation rather than being revoked at teardown, which is exactly what the missing device_unmap() was supposed to prevent.\nI:H - The leaked device mappings are created with dma_dir = DMA_BIDIRECTIONAL whenever the VMA is not read-only, so the stale window is device-writable as well as readable, leaving an attacker-influenced DMA write path into peer device memory that has since been handed to another context.\nA:H - Each failed get_pages leaks IOVA space and IOMMU page-table memory with no bound, and __xe_svm_handle_pagefault() re-enters `goto retry` while holding vm->lock for write, so an unprivileged loop rapidly exhausts the device's IOVA/DMA resources and makes subsequent dma_map_resource()/dma_map_page() calls fail system-wide, hanging or wedging GPU clients on the machine." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/drm_gpusvm.c" ], "versions": [ { "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9", "lessThan": "e8362523fd1b61712f7d996802f9b5dee545c7e6", "status": "affected", "versionType": "git" }, { "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9", "lessThan": "72e4fca5529e45b5beebad79d804de442f632324", "status": "affected", "versionType": "git" }, { "version": "f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9", "lessThan": "7f708f51e3955bda0d77a0b67ab9bea6c97fea99", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/drm_gpusvm.c" ], "versions": [ { "version": "6.18", "status": "affected" }, { "version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e8362523fd1b61712f7d996802f9b5dee545c7e6" }, { "url": "https://git.kernel.org/stable/c/72e4fca5529e45b5beebad79d804de442f632324" }, { "url": "https://git.kernel.org/stable/c/7f708f51e3955bda0d77a0b67ab9bea6c97fea99" } ], "title": "drm/gpusvm: publish dpagemap early to avoid device mapping leak on error", "x_generator": { "engine": "bippy-1.2.0" } } } }