CVE-2026-68427

Full vulnerability record from the local CVENow database.
Description

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.
Severity
HIGH
CVSS score
7.8 (v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-10 13:20:36.653000
Last modified
2026-10-19 22:17:18.843000
View original CVE JSON
{
  "id": "CVE-2026-68427",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-08-10T13:20:36.653",
  "lastModified": "2026-10-19T22:17:18.843",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can't dereference mapping afterwards. The cache itself\noutlives the mapping, so use the cache local variable instead."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/gpu/host1x/bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "af755456299d44e4ed6af3b7c70a7f03ea37fdf1",
              "lessThan": "86a9bd8c8f422d5f3079da31e151868902fcc702",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "71c017b3f83ff72638f2a1b1d6d4e7bc61d30231",
              "lessThan": "abeff53233b984571b87582bb588b4b38ef4ea50",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602",
              "lessThan": "5b7e5f84d3d4cea10c3764d2da274810a7934228",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "8c0d3cf0d5108c96317e0eca92b60dd368867cef",
              "lessThan": "5f4de3c717d34a24d555af581947742980778c02",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "df63c76f9c8d881ca7bce1aecfba512328d0527d",
              "lessThan": "b773faa32b0a98c3eb2b50d96de631681e5d1157",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc",
              "lessThan": "266cddf7bd0f6c79b6c0633aef742a22bf70265b",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/gpu/host1x/bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.1.178",
              "lessThan": "6.1.183",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.6.145",
              "lessThan": "6.6.148",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.12.97",
              "lessThan": "6.12.101",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.18.40",
              "lessThan": "6.18.42",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "7.1.5",
              "lessThan": "7.1.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T15:48:49.447311Z",
          "id": "CVE-2026-68427",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}