CVE-2026-68240: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
In the Linux kernel, the following vulnerability has been resolved:
drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
drmgpusvmgetpages() only stored the local dpagemap into svmpages->dpagemap on the success path. If a later page failed (e.g. -EOPNOTSUPP when ctx->allowmixed is false) and jumped to errunmap, svmpages->dpagemap was still NULL, so drmgpusvmunmappages() skipped deviceunmap() and leaked the device mappings already created.
Assign svmpages->dpagemap when the first device page is mapped so the errunmap path can deviceunmap() those mappings.
This issue was found by Sashiko AI review.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68240?
CVE-2026-68240 has a risk rating of 37, indicating a moderate severity level.
How do I fix CVE-2026-68240?
To fix CVE-2026-68240, ensure that you update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2026-68240?
CVE-2026-68240 affects various versions of the Linux kernel where the drm/gpusvm component is utilized.
What type of vulnerability is CVE-2026-68240?
CVE-2026-68240 is a device mapping leak vulnerability in the Linux kernel's drm/gpusvm component.
When was CVE-2026-68240 published?
CVE-2026-68240 was published on August 10, 2026.