CVE-2026-68272

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL-pointer dereference exists in the amdgpu driver. An unprivileged process in the render group can trigger this by submitting an AMDGPU CHUNK ID CP GFX SHADOW chunk with the length dw variable set to 0. In this scenario, the vmemdup array user() function returns ZERO SIZE PTR, which is then dereferenced as a drm amdgpu cs chunk cp gfx shadow struct within the amdgpu cs p2 shadow() function when reading shadow->flags, leading to a system fault. The issue occurs because the amdgpu cs pass1() function failed to validate the minimum length of the chunk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.