AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-68240

HIGH · CVSS 8.8 EPSS 0.16%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The vulnerability in the Linux kernel affects the Direct Rendering Manager (DRM) subsystem, specifically in the handling of device mappings during error conditions in the gpu virtual memory management. If an error occurs after some device pages have been mapped, the failure to properly unmap these pages can lead to a leak of device mappings, potentially exposing sensitive information. Organizations utilizing Linux systems with GPU support should prioritize this issue to mitigate potential security risks associated with data leakage.

CVE
CVE-2026-68240
Severity
HIGH
CVSS
8.8
EPSS
0.16%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drm_gpusvm_get_pages() only stored the local dpagemap into svm_pages->dpagemap on the success path. If a later page failed (e.g. -EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap, svm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped device_unmap() and leaked the device mappings already created. Assign svm_pages->dpagemap when the first device page is mapped so the err_unmap path can device_unmap() those mappings. This issue was found by Sashiko AI review.