CVE-2026-68427

What it actually does

Use-after-free in host1x driver where __host1x_bo_unpin releases the final reference and frees the mapping, yet host1x_bo_clear_cached_mappings subsequently dereferences the stale pointer instead of a cached local variable.

Why it matters to the business

Local attackers on affected Linux systems can achieve kernel-level code execution or trigger crashes, enabling privilege escalation or denial of service that disrupts GPU-accelerated workloads.

How an attack unfolds

An attacker with local access triggers host1x buffer operations that cause the final unpin of a mapping; the subsequent dereference of the freed mapping pointer allows memory corruption that can be turned into arbitrary kernel code execution.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the freed mapping dereference with the cache local variable in host1x_bo_clear_cached_mappings.

How to confirm the fix worked

Inspect the host1x driver source to confirm the mapping pointer is no longer used after __host1x_bo_unpin and run regression tests exercising cached mapping clear paths under memory pressure.

Typical attack path

1. Obtain local unprivileged access on a Linux host with host1x driver loaded
2. Perform GPU or display operations that exercise host1x buffer pinning and unpinning paths
3. Trigger the race or reference-counting condition that frees the mapping while host1x_bo_clear_cached_mappings still holds a dangling pointer
4. Leverage the resulting use-after-free for memory corruption and privilege escalation

How to detect it

Search kernel logs and dmesg for host1x oops messages, use-after-free warnings, or crashes involving buffer object unpinning; correlate with processes performing GPU or display operations.

What your security team should do

• Apply the host1x use-after-free fix to all kernels with host1x support as soon as patches are available
• Limit unprivileged local access on systems exposing host1x interfaces
• Monitor kernel logs for host1x-related oops or use-after-free warnings