CVE-2026-68380

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable path is the AMDXDNA_EXEC_CMD ioctl on the /dev/accel/accel* accel/DRM node, requiring local access to the device file; there is no remote or adjacent-network entry point into the NPU job scheduler.

AC:LAttack complexity, low

The attacker controls both sides of the lifetime race: it can saturate the hwctx job semaphore with long-running commands to keep jobs queued, then submit from a forked task sharing the fd and exit that task so its mm_struct is freed while the job is still pending. No condition outside attacker control is needed.

PR:LPrivileges required, low

The EXEC_CMD ioctl is registered with no privilege flags (unlike SET_STATE which is DRM_ROOT_ONLY), so any unprivileged local user holding an open handle to the accel render node can submit jobs and trigger the bug.

UI:NUser interaction, none

Exploitation is entirely driven by the attacker's own process tree (open, submit, fork, exit); no victim action or interaction with any other user is required.

S:UScope, unchanged

The use-after-free corrupts kernel memory within the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary as a direct consequence of the flaw.

C:HConfidentiality impact, high

The freed mm_struct is reallocated from a general kernel cache, and the driver's continued use of it (mmget_not_zero, later mmput_async/__mmput walking page tables) gives an attacker who sprays the reclaimed slot a path to disclose arbitrary kernel memory.

I:HIntegrity impact, high

mmget_not_zero() performs an atomic increment into freed memory and mmput_async() can drive a reclaimed object through __mmput()/exit_mmap(), yielding controlled kernel writes and page-table teardown on attacker-shaped data, i.e. a route to privilege escalation.

A:HAvailability impact, high

Even without full exploitation the use-after-free reliably corrupts an mm_struct that the kernel then dereferences and tears down, causing oops or panic and rendering the system unavailable.