---
id: CVE-2026-68103
title: 'drm/amdgpu: reject mapping a reserved doorbell to a new queue'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: reject mapping a reserved doorbell to a new queue

  When creating an user-queue, the user space
  provides a doorbell BO handle and an offset within
  the bo to …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8949843762631d9d0fc526dfb61a272dca29fc6f <
    1050d258c7c56066d2dcaedf8d0ef66364062adc
  - >-
    Linux >= 8949843762631d9d0fc526dfb61a272dca29fc6f <
    a609b6278bf3cde17eeee6620091465521e4b02c
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:43:48.984694Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:52:56.611Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68103'
references:
  - url: 'https://git.kernel.org/stable/c/1050d258c7c56066d2dcaedf8d0ef66364062adc'
  - url: 'https://git.kernel.org/stable/c/a609b6278bf3cde17eeee6620091465521e4b02c'
tags:
  - cve.org
epss: 0.00151
epssPercentile: 0.03884
ingestedAt: '2026-10-16T17:24:46.841Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: reject mapping a reserved doorbell to a new queue

When creating an user-queue, the user space
provides a doorbell BO handle and an offset within
the bo to obtain a doorbell.

However current implementation using xa_store_irq()
to store a doorbell, which allows a later queue created
with the same BO and offset parameters to overwrite an
existing queue and doorbell mapping.

This can cause problems like misrouting fence IRQ
processing to a wrong queue, and mislead the cleanup
process of one queue erasing the mapping of another queue.

This commit fixes this issue by replacing xa_store_irq with
xa_insert_irq, which rejects mapping a reserved
doorbell to a newly created queue

(cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e)

## Affected

- `Linux >= 8949843762631d9d0fc526dfb61a272dca29fc6f < 1050d258c7c56066d2dcaedf8d0ef66364062adc`
- `Linux >= 8949843762631d9d0fc526dfb61a272dca29fc6f < a609b6278bf3cde17eeee6620091465521e4b02c`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.