{"id":"CVE-2026-68103","revision":"bace5fdda6704f749b9893f298559590","records":[{"revision":"bace5fdda6704f749b9893f298559590","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68103","aliases":[],"title":"drm/amdgpu: reject mapping a reserved doorbell to a new queue","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: reject mapping a reserved doorbell to a new queue\n\nWhen creating an user-queue, the user space\nprovides a doorbell BO handle and an offset within\nthe bo to obtain a doorbell.\n\nHowever current implementation using xa_store_irq()\nto store a doorbell, which allows a later queue created\nwith the same BO and offset parameters to overwrite an\nexisting queue and doorbell mapping.\n\nThis can cause problems like misrouting fence IRQ\nprocessing to a wrong queue, and mislead the cleanup\nprocess of one queue erasing the mapping of another queue.\n\nThis commit fixes this issue by replacing xa_store_irq with\nxa_insert_irq, which rejects mapping a reserved\ndoorbell to a newly created queue\n\n(cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e)","state":0,"publishedAt":"2026-08-10T11:58:19.317+00:00","modifiedAt":"2026-10-19T20:58:50.51+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8949843762631d9d0fc526dfb61a272dca29fc6f\",\n                            \"lessThan\": \"1050d258c7c56066d2dcaedf8d0ef66364062adc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8949843762631d9d0fc526dfb61a272dca29fc6f\",\n                            \"lessThan\": \"a609b6278bf3cde17eeee6620091465521e4b02c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":7.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/1050d258c7c56066d2dcaedf8d0ef66364062adc","https://git.kernel.org/stable/c/a609b6278bf3cde17eeee6620091465521e4b02c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68103","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68103","identifiers":["CVE-2026-68103"]},"retained":false,"historicalAffected":[]}],"coverage":[]}