01 Record

CVE-2026-68427

gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.12% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 2.2% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-08-10 12:04Z2 MO AGO

Last updated

2026-10-19 21:09Z9 DAYS AGO

Reserved

2026-07-30

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

2ec522643cea09b0f64bc68fbda106ddf48402a4bcc5f927cb6c5ac4e49f055f

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxaf755456299d44e4ed6af3b7c70a7f03ea37fdf1 to < 86a9bd8c8f422d5f3079da31e151868902fcc702, 71c017b3f83ff72638f2a1b1d6d4e7bc61d30231 to < abeff53233b984571b87582bb588b4b38ef4ea50, 0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602 to < 5b7e5f84d3d4cea10c3764d2da274810a7934228, 8c0d3cf0d5108c96317e0eca92b60dd368867cef to < 5f4de3c717d34a24d555af581947742980778c02, df63c76f9c8d881ca7bce1aecfba512328d0527d to < b773faa32b0a98c3eb2b50d96de631681e5d1157, 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc to < 266cddf7bd0f6c79b6c0633aef742a22bf70265b, 6.1.178 to < 6.1.183, 6.6.145 to < 6.6.148, 6.12.97 to < 6.12.101, 6.18.40 to < 6.18.42, 7.1.5 to < 7.1.6—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702
git.kernel.orghttps://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50
git.kernel.orghttps://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228
git.kernel.orghttps://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02
git.kernel.orghttps://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157
git.kernel.orghttps://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1
linux-6.12
Fixed in 6.12.101-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.101-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.