drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict
Published Aug 10, 2026
5.5
MEDIUMCVSS 3.1
EPSS 0.21%
Description
If kvmalloc_array() fails in drm_gpusvm_range_evict(), the MM reference acquired earlier is not released, resulting in a reference leak.
Fix this by dropping the MM reference on the kvmalloc_array() failure path.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 6.15StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<6.15
- Version 6.18.42StatusunaffectedConstraints<=6.18.*
- Version 7.1.6StatusunaffectedConstraints<=7.1.*
- Version 7.2StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
No data.
No data.
Red Hat Enterprise Linux 10
kernel
Fix deferred
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel
Fix deferred
Red Hat Enterprise Linux 9
kernel-rt
Fix deferred
Red Hat Enterprise Linux for NVIDIA 26
kernel
Not affected
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-8
Not affected
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-9
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | n/a |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | n/a |
| Red Hat Enterprise Linux for NVIDIA 26 | kernel | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This issue affects systems using the drm/gpusvm GPU shared virtual memory interface. If kvmalloc_array() fails in drm_gpusvm_range_evict(), an acquired MM reference is not dropped, leaking address-space references. Systems without gpusvm-capable GPU drivers are not affected.
References (8)
- https://access.redhat.com/security/cve/CVE-2026-68232 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2513321 Issue Tracking
- https://git.kernel.org/stable/c/847b371debf3c8c72384ab7b9a0c4123a74cc925
- https://git.kernel.org/stable/c/a2212fef8e18724e06432fce01fa257296d9f053
- https://git.kernel.org/stable/c/adf0542659c783c962f4a8f2adcb3532ed54821c
- https://lore.kernel.org/linux-cve-announce/2026081017-CVE-2026-68232-1fca@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2026-68232
- https://www.cve.org/CVERecord?id=CVE-2026-68232
Change history (0)
No recorded changes yet.