CVE-2026-68105

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68105", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.368Z", "datePublished": "2026-08-10T11:58:22.101Z", "dateUpdated": "2026-10-21T12:43:29.891Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:43:29.891Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix kernel panic during driver load failure\n\nAvoid kernel panic if MES init fails during driver load. The KIQ ring is\nfalsely marked as ready as ASICs that use MES, KIQ is owned by MES.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: 0010:gfx_v12_1_wait_reg_mem+0x5a/0x1f0 [amdgpu]\nCall Trace:\n gfx_v12_1_ring_emit_reg_write_reg_wait+0x1f/0x30 [amdgpu]\n amdgpu_gmc_fw_reg_write_reg_wait+0xb2/0x190 [amdgpu]\n amdgpu_gmc_flush_gpu_tlb+0x1cc/0x230 [amdgpu]\n amdgpu_gart_invalidate_tlb+0x81/0xa0 [amdgpu]\n amdgpu_gart_unbind+0x72/0x90 [amdgpu]\n amdgpu_ttm_backend_unbind+0xa4/0xb0 [amdgpu]\n amdgpu_ttm_tt_unpopulate+0x13/0xd0 [amdgpu]\n amdttm_tt_unpopulate+0x29/0x70 [amdttm]\n ttm_bo_put+0x1eb/0x360 [amdttm]\n amdgpu_bo_free_kernel+0xf9/0x1f0 [amdgpu]\n amdgpu_ih_ring_fini+0x5a/0x90 [amdgpu]\n amdgpu_irq_fini_hw+0x58/0x80 [amdgpu]\n amdgpu_device_fini_hw+0x4e0/0x5b0 [amdgpu]\n amdgpu_driver_load_kms+0x60/0xa0 [amdgpu]\n amdgpu_pci_probe+0x28e/0x6d0 [amdgpu]\n pci_device_probe+0x19f/0x220\n really_probe+0x1ed/0x340\n driver_probe_device+0x1e/0x80\n __driver_attach+0xd3/0x1a0\n bus_for_each_dev+0x68/0xa0\n bus_add_driver+0x19f/0x270\n driver_register+0x5d/0xf0\n do_one_initcall+0xac/0x200\n do_init_module+0x1ec/0x280\n __se_sys_finit_module+0x2de/0x310\n do_syscall_64+0x6a/0x250\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n(cherry picked from commit 4623b958dd6da0f4c3026afdf330626a09ecb0f0)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c", "drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c"], "versions": [{"version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38", "lessThan": "b437e9b88b47fdf6d8d9d02651b8b56b9162de9a", "status": "affected", "versionType": "git"}, {"version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38", "lessThan": "f7e744bac9a720740a60d19319e8e5ed5e5c3c76", "status": "affected", "versionType": "git"}, {"version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38", "lessThan": "5bc93f907bad7e076d814664dfab8fc230efca3d", "status": "affected", "versionType": "git"}, {"version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38", "lessThan": "a279bd143b3c184358b658e43a057e31ee8c4de5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c", "drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b437e9b88b47fdf6d8d9d02651b8b56b9162de9a"}, {"url": "https://git.kernel.org/stable/c/f7e744bac9a720740a60d19319e8e5ed5e5c3c76"}, {"url": "https://git.kernel.org/stable/c/5bc93f907bad7e076d814664dfab8fc230efca3d"}, {"url": "https://git.kernel.org/stable/c/a279bd143b3c184358b658e43a057e31ee8c4de5"}], "title": "drm/amdgpu: Fix kernel panic during driver load failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c", "drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b437e9b88b47fdf6d8d9d02651b8b56b9162de9a", "status": "affected", "version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38", "versionType": "git"}, {"lessThan": "f7e744bac9a720740a60d19319e8e5ed5e5c3c76", "status": "affected", "version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38", "versionType": "git"}, {"lessThan": "5bc93f907bad7e076d814664dfab8fc230efca3d", "status": "affected", "version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38", "versionType": "git"}, {"lessThan": "a279bd143b3c184358b658e43a057e31ee8c4de5", "status": "affected", "version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c", "drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix kernel panic during driver load failure\n\nAvoid kernel panic if MES init fails during driver load. The KIQ ring is\nfalsely marked as ready as ASICs that use MES, KIQ is owned by MES.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: 0010:gfx_v12_1_wait_reg_mem+0x5a/0x1f0 [amdgpu]\nCall Trace:\n gfx_v12_1_ring_emit_reg_write_reg_wait+0x1f/0x30 [amdgpu]\n amdgpu_gmc_fw_reg_write_reg_wait+0xb2/0x190 [amdgpu]\n amdgpu_gmc_flush_gpu_tlb+0x1cc/0x230 [amdgpu]\n amdgpu_gart_invalidate_tlb+0x81/0xa0 [amdgpu]\n amdgpu_gart_unbind+0x72/0x90 [amdgpu]\n amdgpu_ttm_backend_unbind+0xa4/0xb0 [amdgpu]\n amdgpu_ttm_tt_unpopulate+0x13/0xd0 [amdgpu]\n amdttm_tt_unpopulate+0x29/0x70 [amdttm]\n ttm_bo_put+0x1eb/0x360 [amdttm]\n amdgpu_bo_free_kernel+0xf9/0x1f0 [amdgpu]\n amdgpu_ih_ring_fini+0x5a/0x90 [amdgpu]\n amdgpu_irq_fini_hw+0x58/0x80 [amdgpu]\n amdgpu_device_fini_hw+0x4e0/0x5b0 [amdgpu]\n amdgpu_driver_load_kms+0x60/0xa0 [amdgpu]\n amdgpu_pci_probe+0x28e/0x6d0 [amdgpu]\n pci_device_probe+0x19f/0x220\n really_probe+0x1ed/0x340\n driver_probe_device+0x1e/0x80\n __driver_attach+0xd3/0x1a0\n bus_for_each_dev+0x68/0xa0\n bus_add_driver+0x19f/0x270\n driver_register+0x5d/0xf0\n do_one_initcall+0xac/0x200\n do_init_module+0x1ec/0x280\n __se_sys_finit_module+0x2de/0x310\n do_syscall_64+0x6a/0x250\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n(cherry picked from commit 4623b958dd6da0f4c3026afdf330626a09ecb0f0)"}], "id": "CVE-2026-68105", "lastModified": "2026-10-21T13:19:24.993", "metrics": {}, "published": "2026-08-10T13:19:55.223", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5bc93f907bad7e076d814664dfab8fc230efca3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a279bd143b3c184358b658e43a057e31ee8c4de5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b437e9b88b47fdf6d8d9d02651b8b56b9162de9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f7e744bac9a720740a60d19319e8e5ed5e5c3c76"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdgpu: Denial of Service via MES initialization failure", "id": "2513261", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513261"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: Fix kernel panic during driver load failure\nAvoid kernel panic if MES init fails during driver load. The KIQ ring is\nfalsely marked as ready as ASICs that use MES, KIQ is owned by MES.\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: 0010:gfx_v12_1_wait_reg_mem+0x5a/0x1f0 [amdgpu]\nCall Trace:\ngfx_v12_1_ring_emit_reg_write_reg_wait+0x1f/0x30 [amdgpu]\namdgpu_gmc_fw_reg_write_reg_wait+0xb2/0x190 [amdgpu]\namdgpu_gmc_flush_gpu_tlb+0x1cc/0x230 [amdgpu]\namdgpu_gart_invalidate_tlb+0x81/0xa0 [amdgpu]\namdgpu_gart_unbind+0x72/0x90 [amdgpu]\namdgpu_ttm_backend_unbind+0xa4/0xb0 [amdgpu]\namdgpu_ttm_tt_unpopulate+0x13/0xd0 [amdgpu]\namdttm_tt_unpopulate+0x29/0x70 [amdttm]\nttm_bo_put+0x1eb/0x360 [amdttm]\namdgpu_bo_free_kernel+0xf9/0x1f0 [amdgpu]\namdgpu_ih_ring_fini+0x5a/0x90 [amdgpu]\namdgpu_irq_fini_hw+0x58/0x80 [amdgpu]\namdgpu_device_fini_hw+0x4e0/0x5b0 [amdgpu]\namdgpu_driver_load_kms+0x60/0xa0 [amdgpu]\namdgpu_pci_probe+0x28e/0x6d0 [amdgpu]\npci_device_probe+0x19f/0x220\nreally_probe+0x1ed/0x340\ndriver_probe_device+0x1e/0x80\n__driver_attach+0xd3/0x1a0\nbus_for_each_dev+0x68/0xa0\nbus_add_driver+0x19f/0x270\ndriver_register+0x5d/0xf0\ndo_one_initcall+0xac/0x200\ndo_init_module+0x1ec/0x280\n__se_sys_finit_module+0x2de/0x310\ndo_syscall_64+0x6a/0x250\nentry_SYSCALL_64_after_hwframe+0x4b/0x53\n(cherry picked from commit 4623b958dd6da0f4c3026afdf330626a09ecb0f0)", "A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. When the Multimedia Engine Scheduler (MES) fails to initialize during driver loading, the Kernel Input Queue (KIQ) ring is incorrectly marked as ready. This can lead to a kernel panic, resulting in a Denial of Service (DoS) to the system."], "name": "CVE-2026-68105", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T11:58:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68105\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68105\nhttps://git.kernel.org/stable/c/5bc93f907bad7e076d814664dfab8fc230efca3d\nhttps://git.kernel.org/stable/c/a279bd143b3c184358b658e43a057e31ee8c4de5"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5bc93f907bad7e076d814664dfab8fc230efca3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a279bd143b3c184358b658e43a057e31ee8c4de5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.1.6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T14:00:07.572753+00:00", "updated": "2026-08-13T09:30:07.087866+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}