What is the CVSS score of CVE-2026-68106?

CVE-2026-68106 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68106?

A privilege escalation vulnerability in Linux kernel's AMD GPU driver (CVE-2026-68106, CVSS 7.8) affects organizations running Linux systems with AMD GPU acceleration.. A patch is available.

How to fix or mitigate CVE-2026-68106?

Within 24 hours, identify all Linux systems running kernel versions prior to 6.6.148, 6.12.101, 6.18.42, or 7.1.6 with AMD GPU support. Within 7 days, deploy patched kernel versions (6.6.148, 6.12.101, 6.18.42, 7.1.6, or later) to test and non-critical systems, validating GPU workload compatibility. Within 30 days, complete production rollout with scheduled maintenance windows, reboots, and post-patch GPU functionality validation.

Linux Kernel CVE-2026-68106

EUVD-2026-55487 HIGH

2026-08-10 Linux

GHSA-jxfv-759v-w83r

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.5 MEDIUM

Described primitive is kernel crash only; local render node access required (PR:L, AV:L); no confirmed confidentiality or integrity impact from available evidence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:16 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 11:58 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 11:58 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix division by zero with invalid uvd dimensions

When width or height is less than 16, width_in_mb or height_in_mb becomes 0, leading to fs_in_mb being 0. This causes a division by zero when calculating num_dpb_buffer in H264 and H264 Perf decode paths.

Add validation to reject frames with width < 16 or height < 16 before performing any calculations that depend on these values.

V2: Format change - move up all vaiable definitions. V3: Use warn_once to avoid spam.

(cherry picked from commit 3e41d26c70b0a459d041cc19482a226c4b7423cb)

AnalysisAI

Division by zero in the Linux kernel's amdgpu DRM subsystem (drm/amdgpu UVD driver) allows a local attacker with access to AMD GPU render nodes to crash the kernel or potentially escalate privileges by submitting H264 video decode requests with frame dimensions below 16 pixels. Affected stable branches span kernel versions prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6, all of which now have upstream patches committed. No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (6th percentile) indicates negligible near-term automated exploitation probability.

Technical ContextAI

The vulnerability exists within the amdgpu kernel driver's UVD (Unified Video Decoder) hardware abstraction layer, responsible for offloading H264 video decode operations to AMD GPU silicon. During buffer allocation for H264 and H264 Perf decode paths, the code derives macroblock-aligned dimensions by dividing the frame width and height by 16 (the standard H264 macroblock size). When the supplied width or height is less than 16, integer division produces a zero-valued width_in_mb or height_in_mb, which propagates to fs_in_mb. A subsequent division using this zero value triggers a kernel divide-by-zero exception - a CWE-369 class defect, though NVD has not formally assigned a CWE. The CPE cpe:2.3:a:linux:linux:* confirms broad Linux kernel applicability, though the vulnerable code path is gated behind AMD GPU hardware with UVD support. The fix adds input guards rejecting frames with width or height below 16 before any macroblock arithmetic.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.6.148, 6.12.101, 6.18.42, or 7.1.6 depending on the branch in use. Distribution maintainers for Red Hat, Debian, Ubuntu, SUSE, and Arch should be publishing updated kernel packages tracking these stable tags; apply via standard package management. As a compensating control where immediate kernel upgrade is not feasible, restrict access to DRM render nodes by removing non-essential users from the video and render groups and tightening permissions on /dev/dri/renderD* device files (e.g., chmod 600 or removing group read/write). This prevents unprivileged users from submitting UVD decode requests and closes the local exploitation path, though it will break GPU-accelerated video decode for those users in applications such as FFmpeg, GStreamer, and media players using VA-API or VDPAU. Systems without AMD GPU hardware or with the amdgpu driver not loaded are not exposed and require no action beyond normal patching cadence.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-68106 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68106

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code