CVE-2026-68233

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68233", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.376Z", "datePublished": "2026-08-10T12:00:57.580Z", "dateUpdated": "2026-10-30T12:28:09.594Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:28:09.594Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Shut down BO cache timer before teardown\n\nThe BO cache timer callback schedules time_work, and time_work can rearm\nthe timer through vc4_bo_cache_free_old().\n\nvc4_bo_cache_destroy() deletes the timer and then cancels the work, which\ndoes not break that cycle: the work being cancelled can rearm the timer,\nand the timer then queues work again after teardown.\n\nUse timer_shutdown_sync() instead, so the timer cannot be rearmed and the\ncycle ends with cancel_work_sync()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_bo.c"], "versions": [{"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "948cd4876dafbfab826384516df19fe813d9f1d1", "status": "affected", "versionType": "git"}, {"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "cf55c6f1b62a89bf365c48bf731ccf69340e3a16", "status": "affected", "versionType": "git"}, {"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "e9264ee59bd94970b80b7548f693bccf0d4628da", "status": "affected", "versionType": "git"}, {"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "a38f2724eb93a78ba250b01e0caf3468df4d3956", "status": "affected", "versionType": "git"}, {"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "bac4c1a9af690b8635c6924872075c41d8763ed9", "status": "affected", "versionType": "git"}, {"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "6273dd3ffb54ec581855b82ae77331b66028249c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_bo.c"], "versions": [{"version": "4.5", "status": "affected"}, {"version": "0", "lessThan": "4.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/948cd4876dafbfab826384516df19fe813d9f1d1"}, {"url": "https://git.kernel.org/stable/c/cf55c6f1b62a89bf365c48bf731ccf69340e3a16"}, {"url": "https://git.kernel.org/stable/c/e9264ee59bd94970b80b7548f693bccf0d4628da"}, {"url": "https://git.kernel.org/stable/c/a38f2724eb93a78ba250b01e0caf3468df4d3956"}, {"url": "https://git.kernel.org/stable/c/bac4c1a9af690b8635c6924872075c41d8763ed9"}, {"url": "https://git.kernel.org/stable/c/6273dd3ffb54ec581855b82ae77331b66028249c"}], "title": "drm/vc4: Shut down BO cache timer before teardown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_bo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "948cd4876dafbfab826384516df19fe813d9f1d1", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}, {"lessThan": "cf55c6f1b62a89bf365c48bf731ccf69340e3a16", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}, {"lessThan": "e9264ee59bd94970b80b7548f693bccf0d4628da", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}, {"lessThan": "a38f2724eb93a78ba250b01e0caf3468df4d3956", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}, {"lessThan": "bac4c1a9af690b8635c6924872075c41d8763ed9", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}, {"lessThan": "6273dd3ffb54ec581855b82ae77331b66028249c", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_bo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.5"}, {"lessThan": "4.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Shut down BO cache timer before teardown\n\nThe BO cache timer callback schedules time_work, and time_work can rearm\nthe timer through vc4_bo_cache_free_old().\n\nvc4_bo_cache_destroy() deletes the timer and then cancels the work, which\ndoes not break that cycle: the work being cancelled can rearm the timer,\nand the timer then queues work again after teardown.\n\nUse timer_shutdown_sync() instead, so the timer cannot be rearmed and the\ncycle ends with cancel_work_sync()."}], "id": "CVE-2026-68233", "lastModified": "2026-10-30T13:19:41.720", "metrics": {}, "published": "2026-08-10T13:20:11.600", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6273dd3ffb54ec581855b82ae77331b66028249c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/948cd4876dafbfab826384516df19fe813d9f1d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a38f2724eb93a78ba250b01e0caf3468df4d3956"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bac4c1a9af690b8635c6924872075c41d8763ed9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf55c6f1b62a89bf365c48bf731ccf69340e3a16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e9264ee59bd94970b80b7548f693bccf0d4628da"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel drm/vc4: Improper BO cache timer shutdown leads to system instability", "id": "2513186", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513186"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/vc4: Shut down BO cache timer before teardown\nThe BO cache timer callback schedules time_work, and time_work can rearm\nthe timer through vc4_bo_cache_free_old().\nvc4_bo_cache_destroy() deletes the timer and then cancels the work, which\ndoes not break that cycle: the work being cancelled can rearm the timer,\nand the timer then queues work again after teardown.\nUse timer_shutdown_sync() instead, so the timer cannot be rearmed and the\ncycle ends with cancel_work_sync().", "A flaw was found in the `drm/vc4` component of the Linux kernel. A logic error in the BO cache timer shutdown process allows the timer to be rearmed even after it has been destroyed. This can lead to work being queued again after teardown, potentially causing system instability or a denial of service (DoS) due to improper resource management."], "name": "CVE-2026-68233", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:00:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68233\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68233\nhttps://git.kernel.org/stable/c/6273dd3ffb54ec581855b82ae77331b66028249c\nhttps://git.kernel.org/stable/c/a38f2724eb93a78ba250b01e0caf3468df4d3956\nhttps://git.kernel.org/stable/c/bac4c1a9af690b8635c6924872075c41d8763ed9"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c826a6e1064419f78855463cf29ce9e8b9d25bf4,a38f2724eb93a78ba250b01e0caf3468df4d3956)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c826a6e1064419f78855463cf29ce9e8b9d25bf4,bac4c1a9af690b8635c6924872075c41d8763ed9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c826a6e1064419f78855463cf29ce9e8b9d25bf4,6273dd3ffb54ec581855b82ae77331b66028249c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T15:00:03.822053+00:00", "updated": "2026-08-13T08:45:03.680083+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}