Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-68427— gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.6.148之前版本、6.12.101之前版本、6.18.42之前版本和7.1.6之前版本存在安全漏洞，该漏洞源于host1x_bo_clear_cached_mappings函数中__host1x_bo_unpin()释放映射后仍被解引用，可能导致释放后重用。

CVSS 7.8 · High EPSS 0.12% · P2

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 11

VendorProduct Version RangeStatus
Linux Linux af755456299d44e4ed6af3b7c70a7f03ea37fdf1< 86a9bd8c8f422d5f3079da31e151868902fcc702 affected
71c017b3f83ff72638f2a1b1d6d4e7bc61d30231< abeff53233b984571b87582bb588b4b38ef4ea50 affected
0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602< 5b7e5f84d3d4cea10c3764d2da274810a7934228 affected
8c0d3cf0d5108c96317e0eca92b60dd368867cef< 5f4de3c717d34a24d555af581947742980778c02 affected
df63c76f9c8d881ca7bce1aecfba512328d0527d< b773faa32b0a98c3eb2b50d96de631681e5d1157 affected
3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc< 266cddf7bd0f6c79b6c0633aef742a22bf70265b affected
6.1.178< 6.1.183 affected
6.6.145< 6.6.148 affected
… +3 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-68427

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.6.148之前版本、6.12.101之前版本、6.18.42之前版本和7.1.6之前版本存在安全漏洞，该漏洞源于host1x_bo_clear_cached_mappings函数中__host1x_bo_unpin()释放映射后仍被解引用，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux af755456299d44e4ed6af3b7c70a7f03ea37fdf1 ~ 86a9bd8c8f422d5f3079da31e151868902fcc702 -
Linux Linux 6.1.178 ~ 6.1.183 -

II. Public POCs for CVE-2026-68427

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-68427

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-68427 (5)

Same Patch Batch · Linux · 2026-08-10 · 344 CVEs total

CVE-2026-68388 9.8 CRITICAL smb/client: handle overlapping allocated ranges in fallocate
CVE-2026-68154 9.8 CRITICAL libceph: reject zero bucket types in crush_decode
CVE-2026-68300 9.8 CRITICAL sctp: auth: verify auth requirement when auth_chunk is NULL
CVE-2026-68156 9.8 CRITICAL libceph: refresh auth->authorizer_buf{,_len} after authorizer update
CVE-2026-68158 9.8 CRITICAL libceph: Fix multiplication overflow in decode_new_up_state_weight()
CVE-2026-68159 9.8 CRITICAL libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
CVE-2026-68160 9.8 CRITICAL ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
CVE-2026-68161 9.8 CRITICAL sctp: close UDP tunnel sockets during netns teardown
CVE-2026-68144 9.8 CRITICAL phonet: pep: fix use-after-free in pep_get_sb()
CVE-2026-68170 9.8 CRITICAL mptcp: fix stale skb->sk reference on subflow close
CVE-2026-68137 9.8 CRITICAL net/x25: fix use-after-free in x25_kill_by_neigh()
CVE-2026-68136 9.8 CRITICAL net: gro: fix double aggregation of flush-marked skbs
CVE-2026-68381 9.8 CRITICAL ksmbd: pin conn during async oplock break notification
CVE-2026-68127 9.8 CRITICAL ila: reload IPv6 header after pskb_may_pull in checksum adjust
CVE-2026-68426 9.8 CRITICAL xfrm: fix stale skb->prev after async crypto steals a GSO segment
CVE-2026-68117 9.8 CRITICAL tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
CVE-2026-68385 9.8 CRITICAL s390/checksum: Fix csum_partial() without vector facility
CVE-2026-68302 9.8 CRITICAL amt: re-read skb header pointers after every pull
CVE-2026-68123 9.8 CRITICAL openvswitch: fix GSO userspace truncation underflow
CVE-2026-68124 9.6 CRITICAL mctp: serial: handle zero-length frames to prevent rx buffer overflow

Showing top 20 of 344 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-68427

No comments yet

Leave a comment