Skip to main content

Linux Kernel CVE-2026-68107

| EUVDEUVD-2026-55488 HIGH
2026-08-10 Linux GHSA-37mr-g2c4-w7wf
Information Disclosure Linux
High
Disputed · 8.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

TOCTOU races require reliable timing to exploit, justifying AC:H over official AC:L; scope change and High C/I/A retained given kernel-level memory impact potential.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
2.5 LOW
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:16 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:58 cve.org
HIGH 8.8
CVE Published
Aug 10, 2026 - 11:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn4: avoid rereading IB param length

Reuse the parameter length returned by vcn_v4_0_enc_find_ib_param() instead of rereading it from the IB.

This avoids a potential TOCTOU issue if the IB contents change between reads.

(cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a)

AnalysisAI

Time-of-check to time-of-use (TOCTOU) race condition in the Linux kernel's AMDGPU VCN4 video encoder driver allows a local low-privileged user with GPU device access to corrupt the IB (Indirect Buffer) parameter length between driver reads, potentially achieving out-of-bounds kernel memory access. Affected systems must run AMD RDNA3-class GPU hardware; the official CVSS 3.1 score of 8.8 with scope change (S:C) and High C/I/A ratings implies a local privilege escalation path to kernel level. No public exploit code has been identified and EPSS is 0.17% (6th percentile), indicating low real-world exploitation activity despite the high theoretical severity.

Technical ContextAI

The vulnerability resides in the Linux kernel's DRM (Direct Rendering Manager) subsystem within the drm/amdgpu driver's VCN4 (Video Core Next generation 4) encoder path. Indirect Buffers (IBs) are shared memory regions used to pass GPU command streams from userspace to the kernel driver; userspace processes with render device access can write to these buffers. The affected code path calls vcn_v4_0_enc_find_ib_param() to locate a parameter and retrieve its length, but then rereads that length value directly from the IB memory instead of caching the returned value. Because userspace retains write access to the IB after submission, a concurrent write between the first and second kernel reads constitutes a classic TOCTOU race. No CWE is formally assigned in the submission, but this aligns with CWE-367 (TOCTOU Race Condition) and downstream memory safety issues (CWE-125 or CWE-787) depending on how the stale length value is consumed by subsequent driver logic. Affected products are covered by CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* and practically limited to kernels loaded with the amdgpu module on systems with RDNA3-class hardware.

RemediationAI

Update the Linux kernel to a patched stable release: 6.6.148 or later on the 6.6.x branch, 6.12.101 or later on the 6.12.x branch, 6.18.42 or later on the 6.18.x branch, or 7.1.6 or later on the 7.1.x branch, all available via git.kernel.org (e.g., https://git.kernel.org/stable/c/bbbe6a2a8d8dc87243438d3ffea2083b52d882d9). Distribution-managed kernels (RHEL, Ubuntu, SUSE, Debian, etc.) should receive backported fixes through their standard security update channels. Where immediate kernel patching is not feasible, the primary compensating control is restricting non-root access to AMD GPU render device nodes: remove untrusted users from the 'render' and 'video' groups and apply restrictive permissions to /dev/dri/renderD* devices (e.g., chmod 600), eliminating unprivileged access to the VCN4 encode path at the cost of disabling GPU access for those users. Unloading or blacklisting the amdgpu kernel module (echo 'blacklist amdgpu' >> /etc/modprobe.d/amdgpu-blacklist.conf) is a more aggressive option that fully eliminates the attack surface but disables all AMD GPU functionality including display output on systems relying on it.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68107 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy