{"id":"CVE-2026-68427","title":"gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can't dereference ma…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= af755456299d44e4ed6af3b7c70a7f03ea37fdf1 < 86a9bd8c8f422d5f3079da31e151868902fcc702","Linux >= 71c017b3f83ff72638f2a1b1d6d4e7bc61d30231 < abeff53233b984571b87582bb588b4b38ef4ea50","Linux >= 0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602 < 5b7e5f84d3d4cea10c3764d2da274810a7934228","Linux >= 8c0d3cf0d5108c96317e0eca92b60dd368867cef < 5f4de3c717d34a24d555af581947742980778c02","Linux >= df63c76f9c8d881ca7bce1aecfba512328d0527d < b773faa32b0a98c3eb2b50d96de631681e5d1157","Linux >= 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc < 266cddf7bd0f6c79b6c0633aef742a22bf70265b","Linux >= 6.1.178 < 6.1.183","Linux >= 6.6.145 < 6.6.148","Linux >= 6.12.97 < 6.12.101","Linux >= 6.18.40 < 6.18.42","Linux >= 7.1.5 < 7.1.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:48:49.447311Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:13.228Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68427","references":[{"url":"https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702"},{"url":"https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50"},{"url":"https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228"},{"url":"https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02"},{"url":"https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157"},{"url":"https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b"}],"tags":["cve.org"],"epss":0.00125,"epssPercentile":0.02022,"ingestedAt":"2026-10-16T17:24:46.867Z","slug":"CVE-2026-68427","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can't dereference mapping afterwards. The cache itself\noutlives the mapping, so use the cache local variable instead.\n\n## Affected\n\n- `Linux >= af755456299d44e4ed6af3b7c70a7f03ea37fdf1 < 86a9bd8c8f422d5f3079da31e151868902fcc702`\n- `Linux >= 71c017b3f83ff72638f2a1b1d6d4e7bc61d30231 < abeff53233b984571b87582bb588b4b38ef4ea50`\n- `Linux >= 0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602 < 5b7e5f84d3d4cea10c3764d2da274810a7934228`\n- `Linux >= 8c0d3cf0d5108c96317e0eca92b60dd368867cef < 5f4de3c717d34a24d555af581947742980778c02`\n- `Linux >= df63c76f9c8d881ca7bce1aecfba512328d0527d < b773faa32b0a98c3eb2b50d96de631681e5d1157`\n- `Linux >= 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc < 266cddf7bd0f6c79b6c0633aef742a22bf70265b`\n- `Linux >= 6.1.178 < 6.1.183`\n- `Linux >= 6.6.145 < 6.6.148`\n- `Linux >= 6.12.97 < 6.12.101`\n- `Linux >= 6.18.40 < 6.18.42`\n- `Linux >= 7.1.5 < 7.1.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}