CVE-2026-68260: drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM
In the Linux kernel, the following vulnerability has been resolved:
drm/imagination: acquire vmctx->lock before mapping memory to GPU VM
The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is in progress.
In some cases a find operation will be in progress when doing map/unmap operations, and the find operation will do a NULL pointer dereference.
An example of the stack trace of such NULL dereference is shown below:
Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000000010
[<ffffffff01e989d4>] drmgpuvafind+0x28/0x6c [drmgpuvm] [<ffffffff01ed3a40>] pvrvmunmap+0x34/0x68 [powervr] [<ffffffff01ec69da>] pvrioctlvmunmap+0x2e/0x50 [powervr] [<ffffffff8080ce0a>] drmioctlkernel+0x8e/0xdc [<ffffffff8080d016>] drmioctl+0x1be/0x3e0 [<ffffffff802bec3e>] riscvsysioctl+0xba/0xc4 [<ffffffff80d858b2>] dotrapecallu+0x23e/0x3f4 [<ffffffff80d92288>] handleexception+0x168/0x174
As all occurences of drmgpuvafind() are already guarded by vmctx->lock, make pvrvmmap() to acquire this lock to prevent disturbing any find operation. This fixes the NULL deference problem in drmgpuvafind().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the drm/imagination (powervr) GPU VM code so that vm_ctx->lock is acquired before mapping memory to the GPU VM, preventing map/unmap operations from occurring during an in-progress drm_gpuva_find*() and avoiding the NULL pointer dereference.
Linux kernel drm_gpuvm (drm/imagination / powervr) Acquire vm_ctx->lock before mapping memory to GPU VM (pvr_vm_map) = Ensure pvr_vm_map() acquires vm_ctx->lock so map/unmap cannot run while drm_gpuva_find*() is in progress
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68260?
CVE-2026-68260 has a risk rating of 23, indicating a significant vulnerability in the Linux kernel's drm/imagination code.
How do I fix CVE-2026-68260?
To fix CVE-2026-68260, ensure that vm_ctx->lock is acquired before any mapping of memory to the GPU VM.
What systems are affected by CVE-2026-68260?
CVE-2026-68260 affects systems using the Linux kernel that includes the drm/imagination driver.
What are the consequences of CVE-2026-68260 if exploited?
Exploitation of CVE-2026-68260 may lead to null pointer dereference, causing potential system crashes or instability.
When was CVE-2026-68260 published?
CVE-2026-68260 was published on August 10, 2026.