Cloudanix VulnDB

CVE-2026-68243

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux graphics driver can cause computers with Intel graphics chips to crash when certain internal settings are used incorrectly.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference triggered when an i915 context engine slot is configured with I915_ENGINE_CLASS_INVALID and I915_CONTEXT_PARAM_SSEU is subsequently applied to the same slot, causing a kernel crash in the graphics execution unit parameter handling path.

Why it matters to the business

Unplanned system reboots or kernel panics on Linux hosts using Intel integrated graphics, leading to service interruptions and potential data loss for workloads reliant on GPU acceleration.

How an attack unfolds

An attacker with local access crafts a graphics context, sets an engine slot to the invalid class, then issues an ioctl to apply SSEU parameters to that slot, dereferencing a NULL pointer inside the kernel driver.

How to fix it

Apply the upstream fix from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87 or later equivalent kernel update that guards against invalid engine class before processing SSEU parameters.

How to confirm the fix worked

Verify the patched kernel source contains the NULL check before dereferencing the engine slot in i915_gem_context.c; reproduce the invalid-class + SSEU sequence in a test harness and confirm absence of dereference.

Typical attack path

  1. Obtain local unprivileged access on an affected Linux system
  2. Open a DRM device handle and create a context object
  3. Configure an engine slot with I915_ENGINE_CLASS_INVALID
  4. Issue I915_CONTEXT_PARAM_SSEU ioctl against the same slot
  5. Trigger NULL dereference resulting in kernel oops or panic

How to detect it

Search kernel logs and crash dumps for oops or panic traces containing i915_gem_context and I915_CONTEXT_PARAM_SSEU; correlate with process activity creating DRM contexts shortly before the fault.

  • i915_gem_context.c
  • I915_CONTEXT_PARAM_SSEU
  • I915_ENGINE_CLASS_INVALID

What your security team should do

  • Prioritize kernel upgrade on all Intel GPU-enabled Linux systems within the next maintenance window
  • Restrict unprivileged access to DRM ioctls via SELinux or AppArmor policies until patched
  • Monitor kernel logs for i915-related oops entries mentioning I915_CONTEXT_PARAM_SSEU

The record

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Setting context engine slot N into I915_ENGINE_CLASS_INVALID / I915_ENGINE_CLASS_INVALID_NONE and attempting to apply I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87)

Affected packages

Ecosystem Package Introduced Fixed