---
id: CVE-2026-68240
title: 'drm/gpusvm: publish dpagemap early to avoid device mapping leak on error'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

  drm_gpusvm_get_pages() only stored the local dpagemap into
  svm_pages->dpagemap on the success …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 <
    e8362523fd1b61712f7d996802f9b5dee545c7e6
  - >-
    Linux >= f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 <
    72e4fca5529e45b5beebad79d804de442f632324
  - >-
    Linux >= f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 <
    7f708f51e3955bda0d77a0b67ab9bea6c97fea99
  - Linux 6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:46:05.252837Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:04.363Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68240'
references:
  - url: 'https://git.kernel.org/stable/c/e8362523fd1b61712f7d996802f9b5dee545c7e6'
  - url: 'https://git.kernel.org/stable/c/72e4fca5529e45b5beebad79d804de442f632324'
  - url: 'https://git.kernel.org/stable/c/7f708f51e3955bda0d77a0b67ab9bea6c97fea99'
tags:
  - cve.org
epss: 0.00162
epssPercentile: 0.04925
ingestedAt: '2026-10-16T17:24:46.850Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

drm_gpusvm_get_pages() only stored the local dpagemap into
svm_pages->dpagemap on the success path. If a later page failed (e.g.
-EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap,
svm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped
device_unmap() and leaked the device mappings already created.

Assign svm_pages->dpagemap when the first device page is mapped so the
err_unmap path can device_unmap() those mappings.

This issue was found by Sashiko AI review.

## Affected

- `Linux >= f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 < e8362523fd1b61712f7d996802f9b5dee545c7e6`
- `Linux >= f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 < 72e4fca5529e45b5beebad79d804de442f632324`
- `Linux >= f70da6f99d4f40c5f481c92e3b65d5e36eaa6dc9 < 7f708f51e3955bda0d77a0b67ab9bea6c97fea99`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.