{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68427", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.392Z", "datePublished": "2026-08-10T12:04:47.915Z", "dateUpdated": "2026-08-19T16:35:22.452Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:35:22.452Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can't dereference mapping afterwards. The cache itself\noutlives the mapping, so use the cache local variable instead."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached only through the Tegra DRM/KMS device node (/dev/dri/card0): a local process pins a GEM buffer as a scanout framebuffer via an atomic commit and then destroys the handle, invoking tegra_bo_free_object() -> host1x_bo_clear_cached_mappings(). No network or remote input reaches this code.\nAC:L - The use-after-free is unconditional and deterministic \u2014 every cached mapping freed by host1x_bo_clear_cached_mappings() is dereferenced again for the mutex_unlock. No race must be won and no special memory layout is needed; the attacker fully controls buffer creation, scanout pinning, and the destroy that triggers the free.\nPR:L - An unprivileged local user with access to the Tegra DRM device (video/graphics group, the logged-in console/compositor user on Android, automotive and embedded Tegra systems) can create GEM buffers, present them on a plane and free them. No root or CAP_SYS_ADMIN is required.\nUI:N - The attacking process performs the whole sequence itself \u2014 GEM allocation, atomic plane commit, and handle destruction \u2014 with no action by any other user or victim process.\nS:U - The corruption stays within the kernel's own memory and security authority; there is no crossing into another VM, IOMMU domain, or sandbox boundary.\nC:H - The freed host1x_bo_mapping is read after kfree() to obtain the cache pointer; with slab reuse the attacker can groom the freed object so the read returns attacker-influenced data, and the resulting UAF primitive can be leveraged to disclose kernel memory contents.\nI:H - mutex_unlock() writes to the lock word at the address read from freed memory, so a reallocated/poisoned mapping object yields a write through an attacker-influenceable pointer \u2014 a classic UAF write primitive usable for heap corruption and control-flow hijacking.\nA:H - Dereferencing the freed mapping reliably oopses under slab poisoning/KASAN, and unlocking a bogus mutex address corrupts kernel state, causing a panic or hang; the sequence can be repeated at will to keep the system down."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/host1x/bus.c"], "versions": [{"version": "af755456299d44e4ed6af3b7c70a7f03ea37fdf1", "lessThan": "86a9bd8c8f422d5f3079da31e151868902fcc702", "status": "affected", "versionType": "git"}, {"version": "71c017b3f83ff72638f2a1b1d6d4e7bc61d30231", "lessThan": "abeff53233b984571b87582bb588b4b38ef4ea50", "status": "affected", "versionType": "git"}, {"version": "0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602", "lessThan": "5b7e5f84d3d4cea10c3764d2da274810a7934228", "status": "affected", "versionType": "git"}, {"version": "8c0d3cf0d5108c96317e0eca92b60dd368867cef", "lessThan": "5f4de3c717d34a24d555af581947742980778c02", "status": "affected", "versionType": "git"}, {"version": "df63c76f9c8d881ca7bce1aecfba512328d0527d", "lessThan": "b773faa32b0a98c3eb2b50d96de631681e5d1157", "status": "affected", "versionType": "git"}, {"version": "3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc", "lessThan": "266cddf7bd0f6c79b6c0633aef742a22bf70265b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/host1x/bus.c"], "versions": [{"version": "6.1.178", "lessThan": "6.1.183", "status": "affected", "versionType": "semver"}, {"version": "6.6.145", "lessThan": "6.6.148", "status": "affected", "versionType": "semver"}, {"version": "6.12.97", "lessThan": "6.12.101", "status": "affected", "versionType": "semver"}, {"version": "6.18.40", "lessThan": "6.18.42", "status": "affected", "versionType": "semver"}, {"version": "7.1.5", "lessThan": "7.1.6", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.178", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.145", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.97", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.40", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.5", "versionEndExcluding": "7.1.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702"}, {"url": "https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50"}, {"url": "https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228"}, {"url": "https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02"}, {"url": "https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157"}, {"url": "https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b"}], "title": "gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/host1x/bus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "86a9bd8c8f422d5f3079da31e151868902fcc702", "status": "affected", "version": "af755456299d44e4ed6af3b7c70a7f03ea37fdf1", "versionType": "git"}, {"lessThan": "abeff53233b984571b87582bb588b4b38ef4ea50", "status": "affected", "version": "71c017b3f83ff72638f2a1b1d6d4e7bc61d30231", "versionType": "git"}, {"lessThan": "5b7e5f84d3d4cea10c3764d2da274810a7934228", "status": "affected", "version": "0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602", "versionType": "git"}, {"lessThan": "5f4de3c717d34a24d555af581947742980778c02", "status": "affected", "version": "8c0d3cf0d5108c96317e0eca92b60dd368867cef", "versionType": "git"}, {"lessThan": "b773faa32b0a98c3eb2b50d96de631681e5d1157", "status": "affected", "version": "df63c76f9c8d881ca7bce1aecfba512328d0527d", "versionType": "git"}, {"lessThan": "266cddf7bd0f6c79b6c0633aef742a22bf70265b", "status": "affected", "version": "3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/host1x/bus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.1.183", "status": "affected", "version": "6.1.178", "versionType": "semver"}, {"lessThan": "6.6.148", "status": "affected", "version": "6.6.145", "versionType": "semver"}, {"lessThan": "6.12.101", "status": "affected", "version": "6.12.97", "versionType": "semver"}, {"lessThan": "6.18.42", "status": "affected", "version": "6.18.40", "versionType": "semver"}, {"lessThan": "7.1.6", "status": "affected", "version": "7.1.5", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can't dereference mapping afterwards. The cache itself\noutlives the mapping, so use the cache local variable instead."}], "id": "CVE-2026-68427", "lastModified": "2026-08-19T17:20:49.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:36.653", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings", "id": "2513441", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513441"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can't dereference mapping afterwards. The cache itself\noutlives the mapping, so use the cache local variable instead.", "A flaw was found in the `gpu: host1x` component of the Linux kernel. The `__host1x_bo_unpin()` function incorrectly dereferences a memory mapping after it has been freed, leading to a use-after-free vulnerability. This issue could allow a local attacker to cause memory corruption, potentially leading to a system crash (Denial of Service) or, in more severe scenarios, arbitrary code execution."], "name": "CVE-2026-68427", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68427\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68427\nhttps://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68427-c2c8@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,abeff53233b984571b87582bb588b4b38ef4ea50)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5b7e5f84d3d4cea10c3764d2da274810a7934228)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5f4de3c717d34a24d555af581947742980778c02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b773faa32b0a98c3eb2b50d96de631681e5d1157)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,266cddf7bd0f6c79b6c0633aef742a22bf70265b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.148)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.101)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.1.6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.148,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.101,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.42,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.6,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T17:00:03.761237+00:00", "updated": "2026-08-14T01:00:05.201528+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}