CVE-2026-68303

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68303", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.381Z", "datePublished": "2026-08-10T12:02:37.512Z", "dateUpdated": "2026-10-30T12:28:21.255Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:28:21.255Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hvs/v3d: Fix null dereference in unbind\n\nThe hvs and v3d drivers use dev_get_drvdata(master) in their unbind\nfunctions. Since the vc4-drm gets removed before its dependent drivers\n(vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to\nget drvdata of its master and fails with a null dereference error.\n\nUse the data pointer passed to the unbind functions directly instead of\ndev_get_drvdata(master). This avoids using potentially freed memory."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_hvs.c", "drivers/gpu/drm/vc4/vc4_v3d.c"], "versions": [{"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "3ed3d0b31500b11c8fd9ef96b7703edbccb32e2e", "status": "affected", "versionType": "git"}, {"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "3be8dcc1a5854cf24cc332e0d6fc865c47ff49a1", "status": "affected", "versionType": "git"}, {"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "8f62aae059e06746a18a00af27179c3c0f17f4c7", "status": "affected", "versionType": "git"}, {"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "708688ec31ac6b35103ba364dc300a09930079d4", "status": "affected", "versionType": "git"}, {"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "261f0a3f0ac03248284f5116d3258f89c9642215", "status": "affected", "versionType": "git"}, {"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "7dc3680b7ffe01add3e9299fde8471d2dd53a8ae", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_hvs.c", "drivers/gpu/drm/vc4/vc4_v3d.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3ed3d0b31500b11c8fd9ef96b7703edbccb32e2e"}, {"url": "https://git.kernel.org/stable/c/3be8dcc1a5854cf24cc332e0d6fc865c47ff49a1"}, {"url": "https://git.kernel.org/stable/c/8f62aae059e06746a18a00af27179c3c0f17f4c7"}, {"url": "https://git.kernel.org/stable/c/708688ec31ac6b35103ba364dc300a09930079d4"}, {"url": "https://git.kernel.org/stable/c/261f0a3f0ac03248284f5116d3258f89c9642215"}, {"url": "https://git.kernel.org/stable/c/7dc3680b7ffe01add3e9299fde8471d2dd53a8ae"}], "title": "drm/vc4: hvs/v3d: Fix null dereference in unbind", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_hvs.c", "drivers/gpu/drm/vc4/vc4_v3d.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3ed3d0b31500b11c8fd9ef96b7703edbccb32e2e", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}, {"lessThan": "3be8dcc1a5854cf24cc332e0d6fc865c47ff49a1", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}, {"lessThan": "8f62aae059e06746a18a00af27179c3c0f17f4c7", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}, {"lessThan": "708688ec31ac6b35103ba364dc300a09930079d4", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}, {"lessThan": "261f0a3f0ac03248284f5116d3258f89c9642215", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}, {"lessThan": "7dc3680b7ffe01add3e9299fde8471d2dd53a8ae", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_hvs.c", "drivers/gpu/drm/vc4/vc4_v3d.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hvs/v3d: Fix null dereference in unbind\n\nThe hvs and v3d drivers use dev_get_drvdata(master) in their unbind\nfunctions. Since the vc4-drm gets removed before its dependent drivers\n(vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to\nget drvdata of its master and fails with a null dereference error.\n\nUse the data pointer passed to the unbind functions directly instead of\ndev_get_drvdata(master). This avoids using potentially freed memory."}], "id": "CVE-2026-68303", "lastModified": "2026-10-30T13:19:43.297", "metrics": {}, "published": "2026-08-10T13:20:19.950", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/261f0a3f0ac03248284f5116d3258f89c9642215"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3be8dcc1a5854cf24cc332e0d6fc865c47ff49a1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3ed3d0b31500b11c8fd9ef96b7703edbccb32e2e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/708688ec31ac6b35103ba364dc300a09930079d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7dc3680b7ffe01add3e9299fde8471d2dd53a8ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8f62aae059e06746a18a00af27179c3c0f17f4c7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/vc4: hvs/v3d: Fix null dereference in unbind", "id": "2513147", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513147"}, "csaw": false, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/vc4: hvs/v3d: Fix null dereference in unbind\nThe hvs and v3d drivers use dev_get_drvdata(master) in their unbind\nfunctions. Since the vc4-drm gets removed before its dependent drivers\n(vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to\nget drvdata of its master and fails with a null dereference error.\nUse the data pointer passed to the unbind functions directly instead of\ndev_get_drvdata(master). This avoids using potentially freed memory.", "A flaw was found in the Linux kernel's drm/vc4 drivers, specifically in the hvs and v3d components. When these drivers are being removed, they attempt to access memory that has already been freed. This occurs because they try to retrieve driver data from a master device that is no longer available, leading to a null pointer dereference. A local attacker could potentially exploit this vulnerability to cause system instability or a denial of service (DoS)."], "name": "CVE-2026-68303", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68303\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68303\nhttps://lore.kernel.org/linux-cve-announce/2026081030-CVE-2026-68303-7d13@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8b75bca92cbf064b9fa125fc74a85994452e935,261f0a3f0ac03248284f5116d3258f89c9642215)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8b75bca92cbf064b9fa125fc74a85994452e935,7dc3680b7ffe01add3e9299fde8471d2dd53a8ae)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T18:30:04.230334+00:00", "updated": "2026-08-10T21:00:03.942844+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}