Skip to main content

Linux Kernel EUVDEUVD-2026-55613

| CVE-2026-68427 HIGH
2026-08-10 Linux GHSA-8v73-w5j7-p4x2
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only vector confirmed by description; low privilege and no UI required; full H/H/H impact consistent with kernel UAF privilege escalation potential.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:54 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:04 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 10, 2026 - 12:04 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

__host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.

AnalysisAI

Use-after-free in the Linux kernel's GPU host1x subsystem (host1x_bo_clear_cached_mappings) exposes local low-privileged users to potential kernel heap corruption leading to privilege escalation, memory disclosure, or system crash. The flaw occurs because __host1x_bo_unpin() frees the mapping object, yet the caller continues dereferencing mapping instead of the surviving cache local variable. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation is identified at time of analysis, and EPSS sits at an extremely low 0.16% (6th percentile).

Technical ContextAI

The vulnerability resides in the Linux kernel's drivers/gpu/host1x subsystem, which implements the host interface for NVIDIA Tegra SoC GPU and display hardware. The specific function host1x_bo_clear_cached_mappings manages buffer object cached mapping lifecycle. CWE-416 (Use After Free) is the applicable root cause class despite no formal CWE assignment in this record: __host1x_bo_unpin() drops the final reference count on the mapping struct and deallocates it, but the enclosing function then reads from the now-freed mapping pointer rather than using the already-captured cache local variable that refers to the longer-lived cache object. This is a classic temporal memory safety violation in a kernel refcount-driven teardown path. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* spanning all Linux versions up to the respective stable-branch fix commits.

RemediationAI

Upgrade to one of the vendor-released patched kernel versions: 6.6.148, 6.12.101, 6.18.42, or 7.1.6, depending on which stable branch the deployment tracks; the 7.2-rc4 development snapshot also incorporates the fix. Upstream fix commits are available at https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50, https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228, https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02, https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157, and https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b. As a compensating control where immediate patching is not feasible, restrict local user access to host1x GPU device nodes (e.g., via udev rules or cgroup device controller policies) to reduce the set of users who can trigger the vulnerable code path; note this trade-off will prevent unprivileged GPU workloads from running. Systems without Tegra/host1x hardware are not affected and no action is required.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55613 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy