CVE-2026-68430 - Vulnerability Details

- drm/amdgpu/gfx8: drop unecessary BUG_ON()

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/gfx8: drop unecessary BUG_ON()

There's no need to crash the kernel for this case.

(cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891)

Published: 2026-08-12

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from an unnecessary BUG_ON macro in the AMDGPU driver for gfx8 hardware that would trigger a kernel oops and bring the system down. The trigger is related to an integer underflow condition, identified as CWE-617. Removing the assert prevents the unwarranted crash and does not introduce additional security weaknesses.

Affected Systems

All Linux kernel releases that contain the legacy AMDGPU gfx8 driver and have not yet applied the patch with commit 4d7c25208ca612b. This applies to any distribution that ships with an unfixed kernel, including multiple mainstream releases.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, but the EPSS score of less than 1% and the fact that the vulnerability is not listed in the CISA KEV catalog suggest a very low likelihood of real‑world exploitation. Attacks would require triggering the specific code path that contained the BUG_ON, which is unlikely to be directly exploitable by an external actor.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4e638ae9c1e7a2b85155f2dd91c8105ce109ea7e`	affected	< 69004f1f769f7f6e9e34f4390d98a12aa0b4ab98
`4e638ae9c1e7a2b85155f2dd91c8105ce109ea7e`	affected	< 26ad939b402a754b0624840dfaeebd86d7ff2a22
`4e638ae9c1e7a2b85155f2dd91c8105ce109ea7e`	affected	< 0027afe3dc97a4964a9ea0fb5a3457de06d85f5b
`4e638ae9c1e7a2b85155f2dd91c8105ce109ea7e`	affected	< ab05af6c345bc8460052c60de657ce6d4a2386f7
`4e638ae9c1e7a2b85155f2dd91c8105ce109ea7e`	affected	< 2404600dca5c0979485c6f2d9c62bd356a98870a
`4e638ae9c1e7a2b85155f2dd91c8105ce109ea7e`	affected	< f70bd5235d9efc2ee2f70293eea51888c5f2a54d
`4e638ae9c1e7a2b85155f2dd91c8105ce109ea7e`	affected	< db85aa861b8214fa0d1d8405c01488f604a455a0
`4e638ae9c1e7a2b85155f2dd91c8105ce109ea7e`	affected	< 84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ab05af6c345bc8460052c60de657ce6d4a2386f7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2404600dca5c0979485c6f2d9c62bd356a98870a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f70bd5235d9efc2ee2f70293eea51888c5f2a54d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,db85aa861b8214fa0d1d8405c01488f604a455a0)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5)`	affected	code_commit	—
`[0,6.6.148)`	affected	semver	—
`[0,6.12.101)`	affected	semver	—
`[0,6.18.42)`	affected	semver	—
`[0,7.1.6)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates commit 4d7c25208ca612b (or later) so that the unnecessary BUG_ON has been removed.
If a patched kernel is not available from your distribution, manually apply the patch from commit 4d7c25208ca612b to the kernel source, rebuild, and install via your preferred package or binary mechanism.
Restrict access to the AMDGPU driver for gfx8 hardware during the upgrade period, or disable it if not required, to prevent accidental triggering of the BUG_ON path before the mitigation is in place.

Generated by OpenCVE AI on August 13, 2026 at 01:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0027afe3dc97a4964a9ea0fb5a3457de06d85f5b
https://git.kernel.org/stable/c/2404600dca5c0979485c6f2d9c62bd356a98870a
https://git.kernel.org/stable/c/26ad939b402a754b0624840dfaeebd86d7ff2a22
https://git.kernel.org/stable/c/69004f1f769f7f6e9e34f4390d98a12aa0b4ab98
https://git.kernel.org/stable/c/84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5
https://git.kernel.org/stable/c/ab05af6c345bc8460052c60de657ce6d4a2386f7
https://git.kernel.org/stable/c/db85aa861b8214fa0d1d8405c01488f604a455a0
https://git.kernel.org/stable/c/f70bd5235d9efc2ee2f70293eea51888c5f2a54d
https://lore.kernel.org/linux-cve-announce/2026081254-CVE-2026-68430-3979@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68430
https://www.cve.org/CVERecord?id=CVE-2026-68430

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0027afe3dc97a4964a9ea0fb5a3457de06d85f5b https://git.kernel.org/stable/c/26ad939b402a754b0624840dfaeebd86d7ff2a22 https://git.kernel.org/stable/c/69004f1f769f7f6e9e34f4390d98a12aa0b4ab98

Wed, 12 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://lore.kernel.org/linux-cve-announce/2026081254-CVE-2026-68430-3979@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68430 https://www.cve.org/CVERecord?id=CVE-2026-68430
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUG_ON() There's no need to crash the kernel for this case. (cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891)
Title		drm/amdgpu/gfx8: drop unecessary BUG_ON()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2404600dca5c0979485c6f2d9c62bd356a98870a https://git.kernel.org/stable/c/84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5 https://git.kernel.org/stable/c/ab05af6c345bc8460052c60de657ce6d4a2386f7 https://git.kernel.org/stable/c/db85aa861b8214fa0d1d8405c01488f604a455a0 https://git.kernel.org/stable/c/f70bd5235d9efc2ee2f70293eea51888c5f2a54d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-12T00:07:15.927Z

Updated: 2026-08-19T16:35:27.984Z

Reserved: 2026-07-30T09:28:09.393Z

Link: CVE-2026-68430

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-12T00:17:43.067

Modified: 2026-08-19T17:20:49.890

Link: CVE-2026-68430

Redhat

Severity : Low

Publid Date: 2026-08-12T00:00:00Z

Links: CVE-2026-68430 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T02:30:12Z

Weaknesses

CWE-617
Reachable Assertion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object