Is there a patch available for CVE-2026-68102?

Yes, a patch is available for CVE-2026-68102. Update the affected software to the latest version immediately.

Linux CVE-2026-68102

EUVD-2026-55483

2026-08-10 Linux

GHSA-vhc7-6hrm-49vv

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix aperture mapping leak

amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to always return false, so iounmap(aper_base_kaddr) never runs on normal driver unload, leaving an orphaned entry in the x86 PAT interval tree.

On connected_to_cpu hardware, the aperture is mapped write-back (WB) via ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC) over the same range. The WC vs WB conflict causes:

ioremap error for 0x..., requested 0x1, got 0x0 amdgpu: discovery failed: -2

Fix by switching to devres-managed mappings so cleanup is guaranteed regardless of drm_dev_enter() state:

connected_to_cpu path: devm_memremap(MEMREMAP_WB). For

IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut, returning __va(offset) from the existing kernel direct map. No new ioremap VA or PAT entry is created, so there is nothing to orphan.

dGPU path: devm_ioremap_wc() registers iounmap() as a devres action,

guaranteeing cleanup at device_del() time.

Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio() since the mapping is now devres-owned.

v2: Remove redundant x86_64 guard (Lijo)

(cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a)

Affected VersionsENISA

Linux patch: 7.2-rc2

Linux 9d0af8b4def0de6b734ec8db08e96da0458facb6 <ea772a440d56b285f4d491affac50ecd41f6b402

Linux 9d0af8b4def0de6b734ec8db08e96da0458facb6 <f5988b5c300a32ff751724ffd33d5a8d5873e4a7

Linux 9d0af8b4def0de6b734ec8db08e96da0458facb6 <a343d028ad6c174da8dc6af560c51e6d140a6727

Linux 5.13

Linux patch: 7.1.6

Linux 9d0af8b4def0de6b734ec8db08e96da0458facb6 <6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa

Linux patch: 6.18.42

Linux patch: 6.6.148

Linux patch: 6.12.101

Linux patch: 0

Linux 9d0af8b4def0de6b734ec8db08e96da0458facb6 <67bc3647e418e23dc0d17604bdba634a73de809f

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 11:58 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.