---
id: CVE-2026-68427
title: 'gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

  __host1x_bo_unpin() drops the last reference to the mapping and frees
  it, so we can't dereference ma…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= af755456299d44e4ed6af3b7c70a7f03ea37fdf1 <
    86a9bd8c8f422d5f3079da31e151868902fcc702
  - >-
    Linux >= 71c017b3f83ff72638f2a1b1d6d4e7bc61d30231 <
    abeff53233b984571b87582bb588b4b38ef4ea50
  - >-
    Linux >= 0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602 <
    5b7e5f84d3d4cea10c3764d2da274810a7934228
  - >-
    Linux >= 8c0d3cf0d5108c96317e0eca92b60dd368867cef <
    5f4de3c717d34a24d555af581947742980778c02
  - >-
    Linux >= df63c76f9c8d881ca7bce1aecfba512328d0527d <
    b773faa32b0a98c3eb2b50d96de631681e5d1157
  - >-
    Linux >= 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc <
    266cddf7bd0f6c79b6c0633aef742a22bf70265b
  - Linux >= 6.1.178 < 6.1.183
  - Linux >= 6.6.145 < 6.6.148
  - Linux >= 6.12.97 < 6.12.101
  - Linux >= 6.18.40 < 6.18.42
  - Linux >= 7.1.5 < 7.1.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:48:49.447311Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:13.228Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68427'
references:
  - url: 'https://git.kernel.org/stable/c/86a9bd8c8f422d5f3079da31e151868902fcc702'
  - url: 'https://git.kernel.org/stable/c/abeff53233b984571b87582bb588b4b38ef4ea50'
  - url: 'https://git.kernel.org/stable/c/5b7e5f84d3d4cea10c3764d2da274810a7934228'
  - url: 'https://git.kernel.org/stable/c/5f4de3c717d34a24d555af581947742980778c02'
  - url: 'https://git.kernel.org/stable/c/b773faa32b0a98c3eb2b50d96de631681e5d1157'
  - url: 'https://git.kernel.org/stable/c/266cddf7bd0f6c79b6c0633aef742a22bf70265b'
tags:
  - cve.org
epss: 0.00125
epssPercentile: 0.02022
ingestedAt: '2026-10-16T17:24:46.867Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

__host1x_bo_unpin() drops the last reference to the mapping and frees
it, so we can't dereference mapping afterwards. The cache itself
outlives the mapping, so use the cache local variable instead.

## Affected

- `Linux >= af755456299d44e4ed6af3b7c70a7f03ea37fdf1 < 86a9bd8c8f422d5f3079da31e151868902fcc702`
- `Linux >= 71c017b3f83ff72638f2a1b1d6d4e7bc61d30231 < abeff53233b984571b87582bb588b4b38ef4ea50`
- `Linux >= 0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602 < 5b7e5f84d3d4cea10c3764d2da274810a7934228`
- `Linux >= 8c0d3cf0d5108c96317e0eca92b60dd368867cef < 5f4de3c717d34a24d555af581947742980778c02`
- `Linux >= df63c76f9c8d881ca7bce1aecfba512328d0527d < b773faa32b0a98c3eb2b50d96de631681e5d1157`
- `Linux >= 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc < 266cddf7bd0f6c79b6c0633aef742a22bf70265b`
- `Linux >= 6.1.178 < 6.1.183`
- `Linux >= 6.6.145 < 6.6.148`
- `Linux >= 6.12.97 < 6.12.101`
- `Linux >= 6.18.40 < 6.18.42`
- `Linux >= 7.1.5 < 7.1.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.