CVE-2026-68275

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: check amdgpuvmbofind() result in GETMAPPING_INFO

The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl() looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind(), but uses the returned pointer without checking it.

amdgpuvmbofind() returns NULL when the BO has no bova in that VM, which is the normal case for a BO that has never been mapped. The result is fed straight into amdgpuvmbovaforeachvalidmapping(), which expands to listforeachentry(mapping, &(bova)->valids, list) and dereferences bova, causing a NULL pointer dereference.

This is reachable by any process able to issue the ioctl (render group) simply by requesting mapping info for an unmapped BO.

Return -ENOENT when no bova is found, jumping to outexec so the drm_exec context and GEM object reference are released.

(cherry picked from commit 528b19377affc1cc7362a70a254c1dda793595f9)