CVE-2026-68242 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gt: Fix NULL deref on sched_engine alloc failure
Avoid using intel_context_put() before intel_context_init() in execlists_create_virtual() as the kref_put() inside would lead to NULL deref on the IOCTL path when sched_engine allocation fails.
Discovered using AI-assisted static analysis confirmed by Intel Product Security.
(cherry picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability resides within the intel i915 graphics driver component of the linux kernel, specifically affecting the gpu task scheduling subsystem. The issue manifests as a null pointer dereference that occurs during the execution of graphics workloads on intel graphics hardware. The flaw exists in the execlists_create_virtual() function where improper ordering of context initialization and cleanup operations creates a race condition leading to memory access violations.
The technical root cause stems from improper resource management within the graphics execution engine's scheduling logic. When sched_engine allocation fails during the creation of virtual execution contexts, the code attempts to call intel_context_put() before intel_context_init() has completed successfully. This sequence results in a kref_put() operation being executed against an uninitialized or null reference, causing the kernel to attempt dereferencing a NULL pointer during IOCTL (input/output control) operations.
The vulnerability represents a classic improper resource management flaw that aligns with CWE-476 Null Pointer Dereference and potentially CWE-825 Opportunistic Null Pointer Dereference. The issue is particularly concerning because it occurs in kernel space where such errors can lead to system crashes, privilege escalation opportunities, or denial of service conditions. Attackers could potentially exploit this by triggering specific graphics workloads that cause the scheduler allocation to fail while simultaneously executing IOCTL commands.
The operational impact extends beyond simple system instability as this vulnerability affects the core gpu scheduling mechanism that handles graphics processing tasks for applications using intel graphics hardware. Any application that utilizes intel graphics drivers for rendering operations, including web browsers, video players, and gaming applications, could be affected by this flaw. The vulnerability is particularly relevant in multi-user environments where graphics workloads are common and system stability is critical.
Mitigation strategies should focus on applying the kernel patch that corrects the function call ordering to ensure proper initialization before cleanup operations. System administrators should prioritize updating their linux kernels to versions containing the fix, as the vulnerability can be exploited through normal graphics processing activities without requiring special privileges. The solution involves reordering the context management operations within execlists_create_virtual() to prevent premature resource cleanup that could lead to null pointer dereferences during error conditions. Additionally, organizations should monitor for similar patterns in other kernel subsystems and consider implementing additional static analysis tools to identify potential race conditions and resource management issues.
This vulnerability demonstrates how seemingly minor ordering issues in complex kernel code can create significant security implications, highlighting the importance of rigorous code review processes and automated static analysis in kernel development. The fix implements proper error handling that ensures resources are only cleaned up after successful initialization, preventing the null pointer dereference condition that could otherwise be exploited to crash the system or potentially escalate privileges in certain scenarios.