CVE-2026-68102 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix aperture mapping leak

amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver
fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to
always return false, so iounmap(aper_base_kaddr) never runs on normal
driver unload, leaving an orphaned entry in the x86 PAT interval tree.

On connected_to_cpu hardware, the aperture is mapped write-back (WB) via
ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC)
over the same range. The WC vs WB conflict causes:

ioremap error for 0x..., requested 0x1, got 0x0
amdgpu: discovery failed: -2

Fix by switching to devres-managed mappings so cleanup is guaranteed
regardless of drm_dev_enter() state:

- connected_to_cpu path: devm_memremap(MEMREMAP_WB). For
IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut,
returning __va(offset) from the existing kernel direct map. No new
ioremap VA or PAT entry is created, so there is nothing to orphan.

- dGPU path: devm_ioremap_wc() registers iounmap() as a devres action,
guaranteeing cleanup at device_del() time.

Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio()
since the mapping is now devres-owned.

v2: Remove redundant x86_64 guard (Lijo)

(cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a)

Published: 2026-08-10

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises when the AMDGPU driver fails to unmap a device aperture during normal unload, leaving an obsolete entry in the x86 PAT interval tree. This orphaned mapping can interfere with subsequent memory remapping operations, producing ioremap errors and causing the driver to report a discovery failure. The flaw is a resource leak (CWE-772) and can potentially lead to kernel instability or denial of service. The impact is limited to local systems with AMDGPU hardware and occurs when the driver is loaded and later removed or reloaded.

Affected Systems

The issue affects any Linux kernel running the upstream AMDGPU driver. No specific kernel version range is listed in the CNA data, so all kernel releases that include the affected amdgpu driver code are potentially vulnerable until updated.

Risk and Exploitability

The CVSS score is 4.4, indicating a medium severity. The EPSS score is <1%, suggesting a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. As the flaw occurs in kernel code that runs with elevated privileges, exploiting it requires local access to a system with an AMDGPU device. The issue manifests as a resource leak that can lead to kernel instability, so timely mitigation is recommended.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9d0af8b4def0de6b734ec8db08e96da0458facb6`	affected	< 67bc3647e418e23dc0d17604bdba634a73de809f
`9d0af8b4def0de6b734ec8db08e96da0458facb6`	affected	< a343d028ad6c174da8dc6af560c51e6d140a6727
`9d0af8b4def0de6b734ec8db08e96da0458facb6`	affected	< 6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa
`9d0af8b4def0de6b734ec8db08e96da0458facb6`	affected	< f5988b5c300a32ff751724ffd33d5a8d5873e4a7
`9d0af8b4def0de6b734ec8db08e96da0458facb6`	affected	< ea772a440d56b285f4d491affac50ecd41f6b402

Linux

affected

Version	Status	Constraints
`5.13`	affected	—
`0`	unaffected	< 5.13
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9d0af8b4def0de6b734ec8db08e96da0458facb6,67bc3647e418e23dc0d17604bdba634a73de809f)`	affected	code_commit	—
`[9d0af8b4def0de6b734ec8db08e96da0458facb6,a343d028ad6c174da8dc6af560c51e6d140a6727)`	affected	code_commit	—
`[9d0af8b4def0de6b734ec8db08e96da0458facb6,6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa)`	affected	code_commit	—
`[9d0af8b4def0de6b734ec8db08e96da0458facb6,f5988b5c300a32ff751724ffd33d5a8d5873e4a7)`	affected	code_commit	—
`[9d0af8b4def0de6b734ec8db08e96da0458facb6,ea772a440d56b285f4d491affac50ecd41f6b402)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.13`	affected	generic	—
`[0,5.13)`	unaffected	generic	—
`[6.6.148,7.0.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the recent commit that switches to devres‑managed mappings (e.g., kernel 6.9 or later when the patch is merged).
Verify that the kernel build configuration enables the AMDGPU driver with devres management; rebuild if necessary.
After applying the kernel update, monitor dmesg for any AMDGPU discovery errors and confirm that the "amdgpu: discovery failed" messages no longer appear.

Generated by OpenCVE AI on August 13, 2026 at 08:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa
https://git.kernel.org/stable/c/67bc3647e418e23dc0d17604bdba634a73de809f
https://git.kernel.org/stable/c/a343d028ad6c174da8dc6af560c51e6d140a6727
https://git.kernel.org/stable/c/ea772a440d56b285f4d491affac50ecd41f6b402
https://git.kernel.org/stable/c/f5988b5c300a32ff751724ffd33d5a8d5873e4a7
https://nvd.nist.gov/vuln/detail/CVE-2026-68102
https://www.cve.org/CVERecord?id=CVE-2026-68102

History

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68102 https://www.cve.org/CVERecord?id=CVE-2026-68102
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix aperture mapping leak amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to always return false, so iounmap(aper_base_kaddr) never runs on normal driver unload, leaving an orphaned entry in the x86 PAT interval tree. On connected_to_cpu hardware, the aperture is mapped write-back (WB) via ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC) over the same range. The WC vs WB conflict causes: ioremap error for 0x..., requested 0x1, got 0x0 amdgpu: discovery failed: -2 Fix by switching to devres-managed mappings so cleanup is guaranteed regardless of drm_dev_enter() state: - connected_to_cpu path: devm_memremap(MEMREMAP_WB). For IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut, returning __va(offset) from the existing kernel direct map. No new ioremap VA or PAT entry is created, so there is nothing to orphan. - dGPU path: devm_ioremap_wc() registers iounmap() as a devres action, guaranteeing cleanup at device_del() time. Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio() since the mapping is now devres-owned. v2: Remove redundant x86_64 guard (Lijo) (cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a)
Title		drm/amdgpu: fix aperture mapping leak
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa https://git.kernel.org/stable/c/67bc3647e418e23dc0d17604bdba634a73de809f https://git.kernel.org/stable/c/a343d028ad6c174da8dc6af560c51e6d140a6727 https://git.kernel.org/stable/c/ea772a440d56b285f4d491affac50ecd41f6b402 https://git.kernel.org/stable/c/f5988b5c300a32ff751724ffd33d5a8d5873e4a7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T11:58:18.093Z

Updated: 2026-08-17T04:58:50.338Z

Reserved: 2026-07-30T09:28:09.368Z

Link: CVE-2026-68102

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:19:54.840

Modified: 2026-08-17T05:18:09.540

Link: CVE-2026-68102

Redhat

Severity : Moderate

Publid Date: 2026-08-10T11:58:18Z

Links: CVE-2026-68102 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T09:00:11Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object