EUVD-2026-59527
GHSA-jqc5-8mvc-pp3w
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local access with low-privilege GPU device node permission is required; S:C reflects full kernel compromise scope when invalid DMA mapping leads to ring-0 memory corruption.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
gpu: host1x: Fix iommu_map_sgtable() return value check
Commit "iommu: return full error code from iommu_map_sg[_atomic]()" changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero.
pin_job() also was incorrectly assigning to 'int', which could cause overflows into negative values.
Update pin_job() to correctly check for errors from iommu_map_sgtable.
AnalysisAI
The host1x GPU driver in the Linux kernel mishandles the return value of iommu_map_sgtable() after an upstream API change switched its return type from size_t (unsigned, zero on error) to ssize_t (signed, negative on error), leaving pin_job() blind to failures. Compounded by pin_job() assigning the result to a plain int - risking overflow on large sizes - an IOMMU mapping failure can be silently treated as success, potentially allowing a low-privileged local user on Tegra hardware to trigger kernel memory corruption and escalate privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: local user-level access to a Linux system (physical console, SSH, or container breakout); the system must be running on Tegra SoC hardware with the host1x GPU driver (CONFIG_TEGRA_HOST1X) compiled and loaded; and the attacker must have permission to access the host1x device node (typically /dev/host1x or similar), which usually requires membership in the 'video' or 'render' group, or explicit device ACL grants. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 with AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H signals a credible local privilege escalation path: a low-privileged user with GPU device access triggers a silent mapping failure, the kernel proceeds with an invalid DMA buffer, and memory corruption follows. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a local shell on a Tegra-based Linux system (such as an NVIDIA Jetson board or Tegra-based industrial device) submits a GPU job that causes iommu_map_sgtable() to return a negative error code. Because pin_job() stores the result in an int and uses incorrect comparison logic, the error is silently treated as success, and the GPU job proceeds with an unmapped or invalid DMA buffer. … |
| Remediation | The primary fix is to upgrade the Linux kernel to a patched stable release: 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5, depending on the branch in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Tegra-based systems across production and development environments, including NVIDIA Jetson products and automotive edge platforms, documenting their current Linux kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today