CVE-2026-68107 - Vulnerability Details

- drm/amdgpu/vcn4: avoid rereading IB param length

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn4: avoid rereading IB param length

Reuse the parameter length returned by
vcn_v4_0_enc_find_ib_param() instead of rereading it from
the IB.

This avoids a potential TOCTOU issue if the IB contents
change between reads.

(cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a)

Published: 2026-08-10

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, a race condition exists in the VCN4 subsystem where the interval buffer (IB) parameter length is re‑read instead of reused, allowing the length value to change between the check and the use. This time‑of‑check‑to‑time‑of‑use flaw can lead to inconsistent data handling within the driver, potentially causing unintended behavior.

Affected Systems

The vulnerability is present in all Linux kernel releases that include the VCN4 driver before the commit dbb02b4755f8c1f3773263f2d779872c1c0c073a. Generic kernel builds from major distributions that ship the older driver code are affected. Systems that do not run the VCN4 driver, or are using a kernel version that includes the fix, are not impacted.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity. Exploitation would require precise timing and control over GPU command buffer submission during the race. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. Based on the description, accidental instability could occur in environments that process untrusted GPU command streams.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cfdde9197ecd957281507be99af172671a57755c`	affected	< bbbe6a2a8d8dc87243438d3ffea2083b52d882d9
`6dc4eddeb7e6cca7e1ab32cafbda79d06e652d84`	affected	< ff6aa542d91d76a185f69bd1997b94a560ff5f6b
`2b10cb58d7a3fd621ec9b2ba765a092e562ef998`	affected	< bd868c077f67589ed2a714307ceaade5f246e302
`2b10cb58d7a3fd621ec9b2ba765a092e562ef998`	affected	< c309626bf91fa0a0b583575654e6e14e81f818a3
`2b10cb58d7a3fd621ec9b2ba765a092e562ef998`	affected	< 3b4082fabc67c9780b06eb959e59dd92fa79c0f0
`b1dc92f55b22a80ded8f0263c9ef4ba902303895`	affected	—
`6.6.107`	affected	< 6.6.148
`6.12.48`	affected	< 6.12.101
`6.16.8`	affected	< 6.17

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bbbe6a2a8d8dc87243438d3ffea2083b52d882d9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ff6aa542d91d76a185f69bd1997b94a560ff5f6b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bd868c077f67589ed2a714307ceaade5f246e302)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c309626bf91fa0a0b583575654e6e14e81f818a3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3b4082fabc67c9780b06eb959e59dd92fa79c0f0)`	affected	code_commit	—
`[0,6.6.148)`	affected	semver	—
`[0,6.12.101)`	affected	semver	—
`[0,6.18.42)`	affected	semver	—
`[0,7.1.6)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit dbb02b4755f8c1f3773263f2d779872c1c0c073a.
If upgrading is not immediately possible, disable the VCN4 driver on critical systems or limit its usage.
Restrict or sandbox the submission of untrusted GPU command buffers to mitigate race conditions.

Generated by OpenCVE AI on August 14, 2026 at 01:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00128.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3b4082fabc67c9780b06eb959e59dd92fa79c0f0
https://git.kernel.org/stable/c/bbbe6a2a8d8dc87243438d3ffea2083b52d882d9
https://git.kernel.org/stable/c/bd868c077f67589ed2a714307ceaade5f246e302
https://git.kernel.org/stable/c/c309626bf91fa0a0b583575654e6e14e81f818a3
https://git.kernel.org/stable/c/ff6aa542d91d76a185f69bd1997b94a560ff5f6b
https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68107-cb95@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68107
https://www.cve.org/CVERecord?id=CVE-2026-68107

History

Thu, 13 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Thu, 13 Aug 2026 09:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68107-cb95@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68107 https://www.cve.org/CVERecord?id=CVE-2026-68107
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcn_v4_0_enc_find_ib_param() instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. (cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a)
Title		drm/amdgpu/vcn4: avoid rereading IB param length
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3b4082fabc67c9780b06eb959e59dd92fa79c0f0 https://git.kernel.org/stable/c/bbbe6a2a8d8dc87243438d3ffea2083b52d882d9 https://git.kernel.org/stable/c/bd868c077f67589ed2a714307ceaade5f246e302 https://git.kernel.org/stable/c/c309626bf91fa0a0b583575654e6e14e81f818a3 https://git.kernel.org/stable/c/ff6aa542d91d76a185f69bd1997b94a560ff5f6b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T11:58:24.135Z

Updated: 2026-08-17T04:58:56.350Z

Reserved: 2026-07-30T09:28:09.368Z

Link: CVE-2026-68107

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:19:55.477

Modified: 2026-08-17T05:18:10.103

Link: CVE-2026-68107

Redhat

Severity : Moderate

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68107 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-14T02:00:15Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object