CVE-2026-68103
- Source
- https://cve.org/CVERecord?id=CVE-2026-68103
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68103.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-68103
- Downstream
- Published
- 2026-08-10T11:58:19Z
- Modified
- 2026-08-18T03:31:13Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- drm/amdgpu: reject mapping a reserved doorbell to a new queue
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: reject mapping a reserved doorbell to a new queue
When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell.
However current implementation using xa_store_irq() to store a doorbell, which allows a later queue created with the same BO and offset parameters to overwrite an existing queue and doorbell mapping.
This can cause problems like misrouting fence IRQ processing to a wrong queue, and mislead the cleanup process of one queue erasing the mapping of another queue.
This commit fixes this issue by replacing xa_store_irq with xa_insert_irq, which rejects mapping a reserved doorbell to a newly created queue
(cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e)
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68103.json" }- References
-
- https://git.kernel.org/stable/c/1050d258c7c56066d2dcaedf8d0ef66364062adc
- https://git.kernel.org/stable/c/a609b6278bf3cde17eeee6620091465521e4b02c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68103.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-68103
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git