CVE-2026-68240 drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
A memory leak in the Linux kernel GPU SVM driver allows attackers to exhaust system resources by triggering error paths during page mapping.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68240?
CVE-2026-68240 is a high-severity denial of service vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
drm_gpusvm_get_pages() only stored the local dpagemap into svm_pages->dpagemap on the success path. If a later page failed (e.g. -EOPNOTSUPP when ctx->allow_mixed is false) and jumped to err_unmap, svm_pages->dpagemap was still NULL, so __drm_gpusvm_unmap_pages() skipped device_unmap() and leaked the device mappings already created.
Assign svm_pages->dpagemap when the first device page is mapped so the err_unmap path can device_unmap() those mappings.
This issue was found by Sashiko AI review.
Weakness: CWE-401
Which versions are affected by CVE-2026-68240?
How do I fix CVE-2026-68240?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-68240 being exploited?
There is no known exploitation of CVE-2026-68240 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68240, DEBIAN-CVE-2026-68240, GHSA-hg58-rvxm-hmcv, UBUNTU-CVE-2026-68240.