Use-After-Free Vulnerability in Linux Kernel Affecting Graphics Processing Unit Functionality

CVE-2026-68427

What is CVE-2026-68427?

A use-after-free vulnerability in the Linux kernel has been identified, specifically within the GPU host1x subsystem. The issue arises when the function __host1x_bo_unpin() releases the last reference to a mapping, resulting in potential dereferencing of freed memory. This situation can lead to unpredictable behavior or security risks, as the associated cache may still exist beyond the mapping's lifecycle. The vulnerability has been resolved by ensuring that local variables are utilized appropriately to avoid accessing freed memory.

References