What is the CVSS score of CVE-2026-68260?

CVE-2026-68260 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68260?

Organizations operating Linux systems with PowerVR GPU hardware face kernel-level crash and memory corruption risk through a local privilege escalation path; no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-68260?

Within 24 hours, conduct an inventory of all Linux systems running kernel versions prior to 6.12.101, 7.1.6, or 6.18.42, with particular focus on deployments containing PowerVR GPU hardware and business-critical systems. Within 7 days, deploy the vendor-released patches to staging environments to validate compatibility and system stability, then initiate staged rollout beginning with non-production systems. Within 30 days, complete patch deployment across all affected production systems to achieve full vulnerability remediation.

Linux Kernel CVE-2026-68260

EUVD-2026-55361 HIGH

2026-08-10 Linux

GHSA-qrmv-vc96-x8hw

Denial Of Service Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AV:L and PR:L confirmed by DRM device access requirement; AC:H reflects race condition timing dependency not captured in the vendor-assigned AC:L; C:H/I:H retained for kernel memory corruption potential.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:25 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:01 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:01 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM

The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is in progress.

In some cases a find operation will be in progress when doing map/unmap operations, and the find operation will do a NULL pointer dereference.

An example of the stack trace of such NULL dereference is shown below:

Unable to handle kernel access to user memory without uaccess routines at
virtual address 0000000000000010

[<ffffffff01e989d4>] drm_gpuva_find+0x28/0x6c [drm_gpuvm]
[<ffffffff01ed3a40>] pvr_vm_unmap+0x34/0x68 [powervr]
[<ffffffff01ec69da>] pvr_ioctl_vm_unmap+0x2e/0x50 [powervr]
[<ffffffff8080ce0a>] drm_ioctl_kernel+0x8e/0xdc
[<ffffffff8080d016>] drm_ioctl+0x1be/0x3e0
[<ffffffff802bec3e>] __riscv_sys_ioctl+0xba/0xc4
[<ffffffff80d858b2>] do_trap_ecall_u+0x23e/0x3f4
[<ffffffff80d92288>] handle_exception+0x168/0x174

As all occurences of drm_gpuva_find*() are already guarded by vm_ctx->lock, make pvr_vm_map() to acquire this lock to prevent disturbing any find operation. This fixes the NULL deference problem in drm_gpuva_find*().

AnalysisAI

NULL pointer dereference in the Linux kernel's drm/imagination PowerVR GPU driver allows a local attacker with low privileges to crash the kernel or potentially exploit kernel memory corruption. The vulnerability stems from pvr_vm_map() failing to acquire vm_ctx->lock before performing GPU virtual memory mapping operations, enabling a concurrent drm_gpuva_find() call to dereference a NULL pointer at kernel address offset 0x10 when map and find operations race. No public exploit code or confirmed active exploitation exists; vendor-released patches are available across multiple stable kernel branches as of Linux 6.12.101, 7.1.6, and 6.18.42.

Technical ContextAI

The drm/imagination driver implements PowerVR GPU support within the Linux kernel's DRM (Direct Rendering Manager) subsystem, using the drm_gpuvm library for GPU virtual memory (VA) management. The vulnerable code path involves drm_gpuva_find(), which searches GPU VA space for existing mappings, and pvr_vm_map()/pvr_vm_unmap(), which manage GPU VM mappings via the pvr_ioctl_vm_map and pvr_ioctl_vm_unmap ioctl handlers. The root cause is effectively a race condition (analogous to CWE-362) combined with a resulting NULL pointer dereference (CWE-476): all callers of drm_gpuva_find() were already guarded by vm_ctx->lock except pvr_vm_map(), which did not acquire this lock. When a find operation was in progress concurrently with a map operation, the GPU VA data structure was in an inconsistent intermediate state, causing drm_gpuva_find() to access a NULL pointer at virtual address 0x10. The stack trace shows the crash path as drm_gpuva_find → pvr_vm_unmap → pvr_ioctl_vm_unmap → drm_ioctl on a RISC-V system, though the bug is architecture-agnostic. The affected CPE is cpe:2.3:a:linux:linux:* for kernels containing the introduction commit ff5f643de0bf27874c4033cd57a0bd034b5c7d11 (Linux 6.8 era) prior to the respective fix commits in stable branches.

RemediationAI

Upgrade to a patched kernel release: Linux 6.12.101, 7.1.6, or 6.18.42 (stable branches), or 7.2-rc5 and later (mainline), as confirmed by EUVD-2026-55361 and the four fix commits available at https://git.kernel.org/stable/c/1f1f2618e44b21a7d4eb30d3bbd7e015ffbbbadf and related links. If an immediate kernel upgrade is not feasible, unloading or blacklisting the powervr kernel module (via 'modprobe -r powervr' or adding 'blacklist powervr' to /etc/modprobe.d/) eliminates the vulnerable code path entirely at the cost of disabling PowerVR GPU functionality - an acceptable trade-off for systems not actively using the GPU. As a lesser mitigation, restricting unprivileged user access to DRM render device nodes (removing users from the render/video groups or tightening /dev/dri/renderD* permissions) reduces the local attack surface but does not eliminate the race condition for privileged processes. The NVD advisory is at https://nvd.nist.gov/vuln/detail/CVE-2026-68260.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68260 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68260

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code