CVE-2026-68240 PUBLISHED

drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

Assigner: Linux
Reserved: 30.07.2026 Published: 10.08.2026 Updated: 10.08.2026

In the Linux kernel, the following vulnerability has been resolved:

drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

drm_gpusvm_get_pages() only stored the local dpagemap into svm_pages->dpagemap on the success path. If a later page failed (e.g. -EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap, svm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped device_unmap() and leaked the device mappings already created.

Assign svm_pages->dpagemap when the first device page is mapped so the err_unmap path can device_unmap() those mappings.

This issue was found by Sashiko AI review.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 to e8362523fd1b61712f7d996802f9b5dee545c7e6 (excl.)
  • affected from f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 to 72e4fca5529e45b5beebad79d804de442f632324 (excl.)
  • affected from f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 to 7f708f51e3955bda0d77a0b67ab9bea6c97fea99 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.18 is affected
  • unaffected from 0 to 6.18 (excl.)
  • unaffected from 6.18.44 to 6.18.* (incl.)
  • unaffected from 7.1.6 to 7.1.* (incl.)
  • unaffected from 7.2-rc4 to * (incl.)

References