CVE-2026-68103: drm/amdgpu: reject mapping a reserved doorbell to a new queue
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: reject mapping a reserved doorbell to a new queue
When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell.
However current implementation using xastoreirq() to store a doorbell, which allows a later queue created with the same BO and offset parameters to overwrite an existing queue and doorbell mapping.
This can cause problems like misrouting fence IRQ processing to a wrong queue, and mislead the cleanup process of one queue erasing the mapping of another queue.
This commit fixes this issue by replacing xastoreirq with xainsertirq, which rejects mapping a reserved doorbell to a newly created queue
(cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68103?
CVE-2026-68103 has a risk rating of 34, indicating a moderate level of severity.
How do I fix CVE-2026-68103?
To address CVE-2026-68103, update to the patched version of the Linux kernel that resolves this vulnerability.
What systems are affected by CVE-2026-68103?
CVE-2026-68103 affects the Linux kernel, particularly components related to the amdgpu driver.
What does CVE-2026-68103 involve?
CVE-2026-68103 involves the rejection of mapping a reserved doorbell when creating a user-queue in the Linux kernel.
Is there a workaround for CVE-2026-68103?
Currently, there is no documented workaround for CVE-2026-68103 other than applying the kernel updates.