CVE-2026-68103
N/A
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: reject mapping a reserved doorbell to a new queue
When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell.
However current implementation using xa_store_irq() to store a doorbell, which allows a later queue created with the same BO and offset parameters to overwrite an existing queue and doorbell mapping.
This can cause problems like misrouting fence IRQ processing to a wrong queue, and mislead the cleanup process of one queue erasing the mapping of another queue.
This commit fixes this issue by replacing xa_store_irq with xa_insert_irq, which rejects mapping a reserved doorbell to a newly created queue
(cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e)
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1050d258c7c56066d2dcaedf8d0ef66364062adc | affected |
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a609b6278bf3cde17eeee6620091465521e4b02c | affected |
| Linux | Linux | 0 < 7.1.6 | affected |
| Linux | Linux | 7.1.6 <= 7.1.* | unaffected |
| Linux | Linux | 7.2-rc2 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/1050d258c7c56066d2dcaedf8d0ef66364062adc
- https://git.kernel.org/stable/c/a609b6278bf3cde17eeee6620091465521e4b02c
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.