CVE-2026-68272 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and BO_HANDLES chunk types.
The CP_GFX_SHADOW case previously shared a bare break with the dependency and syncobj chunk types, which do not dereference a fixed-size struct. When userspace submits this chunk with length_dw == 0, vmemdup_array_user() is called with size 0 and returns ZERO_SIZE_PTR, which passes the IS_ERR() check. amdgpu_cs_p2_shadow() then dereferences chunk->kdata as a struct drm_amdgpu_cs_chunk_cp_gfx_shadow (reading shadow->flags), faulting on the ZERO_SIZE_PTR and causing a NULL-pointer dereference.
This is reachable by an unprivileged process in the render group. Reject undersized chunks with -EINVAL during pass1 so the bad submission is rejected before pass2 ever dereferences the data.
(cherry picked from commit 7f61b2eef7415eccdb40850aca0de94211948657)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides within the Linux kernel's AMDGPU driver component, specifically in the graphics command submission processing logic. This flaw affects the drm/amdgpu subsystem where the kernel handles graphics command buffers submitted by user-space applications. The issue manifests during the first pass of command submission processing when validating chunk data structures. The vulnerability stems from an inconsistent validation approach across different chunk types within the AMDGPU command submission framework, creating a potential exploitation vector for privilege escalation attacks.
The technical implementation flaw occurs in the amdgpu_cs_pass1() function where the CP_GFX_SHADOW chunk type lacks proper minimum-length validation compared to other chunk types like IB, FENCE, and BO_HANDLES. The vulnerability exploits a code path that previously shared a bare break statement with dependency and syncobj chunk types, which do not require fixed-size structure dereferencing. When userspace submits a CP_GFX_SHADOW chunk with length_dw set to zero, the vmemdup_array_user() function receives a size parameter of zero and returns ZERO_SIZE_PTR. This pointer passes the IS_ERR() check validation but subsequently causes a NULL-pointer dereference when amdgpu_cs_p2_shadow() attempts to access chunk->kdata as a drm_amdgpu_cs_chunk_cp_gfx_shadow structure, specifically reading the shadow->flags field.
This vulnerability represents a classic null pointer dereference issue that can be exploited by unprivileged processes belonging to the render group. The attack surface is particularly concerning because it allows local privilege escalation without requiring elevated privileges or special capabilities. The validation gap creates a scenario where malformed chunk data can bypass early validation checks and propagate to later processing stages where the invalid memory access occurs. This type of vulnerability aligns with CWE-476 which describes NULL Pointer Dereference, and potentially maps to ATT&CK technique T1068 which covers Exploitation for Privilege Escalation.
The operational impact of this vulnerability extends beyond simple denial-of-service scenarios as it enables potential privilege escalation within the graphics subsystem. Attackers can leverage this flaw to execute arbitrary code with kernel privileges, potentially compromising the entire system. The fix implements proper minimum-length validation for the CP_GFX_SHADOW chunk type during pass1 processing, ensuring that undersized chunks are rejected with -EINVAL before they can be processed in pass2 where the actual memory dereference occurs. This defensive programming approach prevents malformed data from reaching vulnerable code paths and maintains the integrity of the graphics command submission pipeline.
The fix addresses the root cause by adding consistent validation logic that mirrors existing patterns for other chunk types within the same function. The solution ensures that all chunk types undergo identical validation criteria, eliminating the inconsistent behavior that enabled the vulnerability. This remediation aligns with secure coding practices recommended in industry standards and follows established patterns within the Linux kernel's graphics subsystem design. The change maintains backward compatibility while strengthening the overall security posture of the AMDGPU driver component and prevents potential exploitation scenarios that could lead to complete system compromise through local privilege escalation attacks.