« Volver al listado

CVE-2026-68272

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1

Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and BO_HANDLES chunk types.

The CP_GFX_SHADOW case previously shared a bare break with the dependency and syncobj chunk types, which do not dereference a fixed-size struct.

Leer descripción completaMostrar menos

When userspace submits this chunk with length_dw == 0, vmemdup_array_user() is called with size 0 and returns ZERO_SIZE_PTR, which passes the IS_ERR() check. amdgpu_cs_p2_shadow() then dereferences chunk->kdata as a struct drm_amdgpu_cs_chunk_cp_gfx_shadow (reading shadow->flags), faulting on the ZERO_SIZE_PTR and causing a NULL-pointer dereference.

This is reachable by an unprivileged process in the render group. Reject undersized chunks with -EINVAL during pass1 so the bad submission is rejected before pass2 ever dereferences the data.

(cherry picked from commit 7f61b2eef7415eccdb40850aca0de94211948657)

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68272",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ac9287055ff16a092416c76a19006764e4c6a978",
              "lessThan": "3f190956404da55560056ce20606010e18bc059c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac9287055ff16a092416c76a19006764e4c6a978",
              "lessThan": "2aa9ea2bd5146d237c8cc16d8737d878b0298a94",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac9287055ff16a092416c76a19006764e4c6a978",
              "lessThan": "315d2e5741a81b0be763e80413a2677e22b7e596",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac9287055ff16a092416c76a19006764e4c6a978",
              "lessThan": "24668ca3ec19434d7a9574bf9112f2b0614c3a4e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac9287055ff16a092416c76a19006764e4c6a978",
              "lessThan": "84c4c36acd5c4b2558b5069f869a165b2c655c84",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:16.220",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/24668ca3ec19434d7a9574bf9112f2b0614c3a4e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2aa9ea2bd5146d237c8cc16d8737d878b0298a94",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/315d2e5741a81b0be763e80413a2677e22b7e596",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3f190956404da55560056ce20606010e18bc059c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/84c4c36acd5c4b2558b5069f869a165b2c655c84",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1\n\nAdd a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in\namdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and\nBO_HANDLES chunk types.\n\nThe CP_GFX_SHADOW case previously shared a bare break with the dependency\nand syncobj chunk types, which do not dereference a fixed-size struct. When\nuserspace submits this chunk with length_dw == 0, vmemdup_array_user() is\ncalled with size 0 and returns ZERO_SIZE_PTR, which passes the IS_ERR()\ncheck. amdgpu_cs_p2_shadow() then dereferences chunk->kdata as a struct\ndrm_amdgpu_cs_chunk_cp_gfx_shadow (reading shadow->flags), faulting on the\nZERO_SIZE_PTR and causing a NULL-pointer dereference.\n\nThis is reachable by an unprivileged process in the render group. Reject\nundersized chunks with -EINVAL during pass1 so the bad submission is\nrejected before pass2 ever dereferences the data.\n\n(cherry picked from commit 7f61b2eef7415eccdb40850aca0de94211948657)"
    }
  ],
  "lastModified": "2026-08-17T05:18:29.733",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}