CVE-2026-68427
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the gpu: host1x subsystem has a use-after-free vulnerability in host1x_bo_clear_cached_mappings. The __host1x_bo_unpin() function drops the last reference to the mapping and frees it, making later dereference invalid. The fix uses the local cache variable instead.
Risk Assessment
The vulnerability may lead to memory corruption, potentially causing system crashes or privilege escalation in environments with access to this subsystem.
Recommendation
Apply the official Linux kernel patch that fixes the use-after-free in the host1x subsystem as soon as possible.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.