{"id":"CVE-2026-68427","summary":"gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can't dereference mapping afterwards. The cache itself\noutlives the mapping, so use the cache local variable instead.","modified":"2026-08-21T03:30:16.906952046Z","published":"2026-08-10T12:04:47.915Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68427.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02"},{"type":"WEB","url":"https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702"},{"type":"WEB","url":"https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68427.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68427"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"af755456299d44e4ed6af3b7c70a7f03ea37fdf1"},{"fixed":"86a9bd8c8f422d5f3079da31e151868902fcc702"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"71c017b3f83ff72638f2a1b1d6d4e7bc61d30231"},{"fixed":"abeff53233b984571b87582bb588b4b38ef4ea50"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602"},{"fixed":"5b7e5f84d3d4cea10c3764d2da274810a7934228"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8c0d3cf0d5108c96317e0eca92b60dd368867cef"},{"fixed":"5f4de3c717d34a24d555af581947742980778c02"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"df63c76f9c8d881ca7bce1aecfba512328d0527d"},{"fixed":"b773faa32b0a98c3eb2b50d96de631681e5d1157"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc"},{"fixed":"266cddf7bd0f6c79b6c0633aef742a22bf70265b"}]}],"versions":["v6.1.182","v6.1.181","v6.1.180","v6.1.179","v6.1.178","v6.6.147","v6.6.146","v6.6.145","v6.12.100","v6.12.99","v6.12.98","v6.12.97","v6.18.41","v6.18.40","v7.1.5"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68427.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.178"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.6.145"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.12.97"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.18.40"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.1.5"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68427.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}