vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-68427

gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

HIGH
7.8
CVSS Score
Published: August 10, 2026 at 12:04 PM UTC
Updated: October 19, 2026 at 10:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
0e9dd7cfb9986b78cc81eca126ccfbf57f4c06023cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc6.1.1786.12.976.18.406.6.1457.1.571c017b3f83ff72638f2a1b1d6d4e7bc61d302318c0d3cf0d5108c96317e0eca92b60dd368867cefaf755456299d44e4ed6af3b7c70a7f03ea37fdf1df63c76f9c8d881ca7bce1aecfba512328d0527d
Vendor states this is fixed in 266cddf7bd0f6c79b6c0633aef742a22bf70265b (fixed)
Vendor states this is fixed in 5b7e5f84d3d4cea10c3764d2da274810a7934228 (fixed)
Vendor states this is fixed in 5f4de3c717d34a24d555af581947742980778c02 (fixed)
Vendor states this is fixed in 86a9bd8c8f422d5f3079da31e151868902fcc702 (fixed)
Vendor states this is fixed in abeff53233b984571b87582bb588b4b38ef4ea50 (fixed)
Vendor states this is fixed in b773faa32b0a98c3eb2b50d96de631681e5d1157 (fixed)
Affected range stops below 6.1.183, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.12.101, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.18.42, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.6.148, so it looks safe — our inference, not a vendor statement
Affected range stops below 7.1.6, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (6)

Source: cverecord
https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50
Source: cverecord
https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228
Source: cverecord
https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02
Source: cverecord
https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157
Source: cverecord
https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b
Source: cverecord
https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card