CVE-2026-68427

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable path is reached only through the Tegra DRM/KMS device node (/dev/dri/card0): a local process pins a GEM buffer as a scanout framebuffer via an atomic commit and then destroys the handle, invoking tegra_bo_free_object() -> host1x_bo_clear_cached_mappings(). No network or remote input reaches this code.

AC:LAttack complexity, low

The use-after-free is unconditional and deterministic — every cached mapping freed by host1x_bo_clear_cached_mappings() is dereferenced again for the mutex_unlock. No race must be won and no special memory layout is needed; the attacker fully controls buffer creation, scanout pinning, and the destroy that triggers the free.

PR:LPrivileges required, low

An unprivileged local user with access to the Tegra DRM device (video/graphics group, the logged-in console/compositor user on Android, automotive and embedded Tegra systems) can create GEM buffers, present them on a plane and free them. No root or CAP_SYS_ADMIN is required.

UI:NUser interaction, none

The attacking process performs the whole sequence itself — GEM allocation, atomic plane commit, and handle destruction — with no action by any other user or victim process.

S:UScope, unchanged

The corruption stays within the kernel's own memory and security authority; there is no crossing into another VM, IOMMU domain, or sandbox boundary.

C:HConfidentiality impact, high

The freed host1x_bo_mapping is read after kfree() to obtain the cache pointer; with slab reuse the attacker can groom the freed object so the read returns attacker-influenced data, and the resulting UAF primitive can be leveraged to disclose kernel memory contents.

I:HIntegrity impact, high

mutex_unlock() writes to the lock word at the address read from freed memory, so a reallocated/poisoned mapping object yields a write through an attacker-influenceable pointer — a classic UAF write primitive usable for heap corruption and control-flow hijacking.

A:HAvailability impact, high

Dereferencing the freed mapping reliably oopses under slab poisoning/KASAN, and unlocking a bogus mutex address corrupts kernel state, causing a panic or hang; the sequence can be repeated at will to keep the system down.