CVE-2026-68275

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the amdgpu gem op ioctl() function within the AMDGPU GEM OP GET MAPPING INFO path. The issue occurs because the function calls amdgpu vm bo find() to look up the bo va for a buffer object but fails to verify if the returned pointer is NULL. When a buffer object has never been mapped, amdgpu vm bo find() returns NULL, which is then passed to amdgpu vm bo va for each valid mapping(). This leads to a crash when the system attempts to dereference the bo va pointer. Any process with permissions to issue the ioctl (render group) can trigger this by requesting mapping information for an unmapped buffer object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.