gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.
CVE-2026-68427
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-68427
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "af755456299d44e4ed6af3b7c70a7f03ea37fdf1",
"lessThan": "86a9bd8c8f422d5f3079da31e151868902fcc702",
"versionType": "git"
},
{
"status": "affected",
"version": "71c017b3f83ff72638f2a1b1d6d4e7bc61d30231",
"lessThan": "abeff53233b984571b87582bb588b4b38ef4ea50",
"versionType": "git"
},
{
"status": "affected",
"version": "0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602",
"lessThan": "5b7e5f84d3d4cea10c3764d2da274810a7934228",
"versionType": "git"
},
{
"status": "affected",
"version": "8c0d3cf0d5108c96317e0eca92b60dd368867cef",
"lessThan": "5f4de3c717d34a24d555af581947742980778c02",
"versionType": "git"
},
{
"status": "affected",
"version": "df63c76f9c8d881ca7bce1aecfba512328d0527d",
"lessThan": "b773faa32b0a98c3eb2b50d96de631681e5d1157",
"versionType": "git"
},
{
"status": "affected",
"version": "3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc",
"lessThan": "266cddf7bd0f6c79b6c0633aef742a22bf70265b",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/host1x/bus.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1.178",
"lessThan": "6.1.183",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.145",
"lessThan": "6.6.148",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.97",
"lessThan": "6.12.101",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.40",
"lessThan": "6.18.42",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.1.5",
"lessThan": "7.1.6",
"versionType": "semver"
}
],
"programFiles": [
"drivers/gpu/host1x/bus.c"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-68427
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #41723 · Revision 1
- Added to Heist Feed
- Publisher date