CVE-2026-68272
CVE CVE-2026-68272EUVD EUVD-2026-55373Published 2026-08-10T12:01:47.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and BO_HANDLES chunk types. The CP_GFX_SHADOW case previously shared a bare break with the dependency and syncobj chunk types, which do not dereference a fixed-size struct. When userspace submits this chunk with length_dw == 0, vmemdup_array_user() is called with size 0 and returns ZERO_SIZE_PTR, which passes the IS_ERR() check. amdgpu_cs_p2_shadow() then dereferences chunk->kdata as a struct drm_amdgpu_cs_chunk_cp_gfx_shadow (reading shadow->flags), faulting on the ZERO_SIZE_PTR and causing a NULL-pointer dereference. This is reachable by an unprivileged process in the render group. Reject undersized chunks with -EINVAL during pass1 so the bad submission is rejected before pass2 ever dereferences the data. (cherry picked from commit 7f61b2eef7415eccdb40850aca0de94211948657)
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux patch: 7.2-rc1; patch: 7.1.6; patch: 0; ac9287055ff16a092416c76a19006764e4c6a978 <3f190956404da55560056ce20606010e18bc059c; ac9287055ff16a092416c76a19006764e4c6a978 <315d2e5741a81b0be763e80413a2677e22b7e596; ac9287055ff16a092416c76a19006764e4c6a978 <84c4c36acd5c4b2558b5069f869a165b2c655c84; patch: 6.6.148; ac9287055ff16a092416c76a19006764e4c6a978 <2aa9ea2bd5146d237c8cc16d8737d878b0298a94; 6.5; ac9287055ff16a092416c76a19006764e4c6a978 <24668ca3ec19434d7a9574bf9112f2b0614c3a4e; patch: 6.18.42; patch: 6.12.101
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.