CVE-2026-68427

A flaw was found in the gpu: host1x component of the Linux kernel. The __host1x_bo_unpin() function incorrectly dereferences a memory mapping after it has been freed, leading to a use-after-free vulnerability. This issue could allow a local attacker to cause memory corruption, potentially leading to a system crash (Denial of Service) or, in more severe scenarios, arbitrary code execution.

This vulnerability is rated as Moderate impact because exploitation requires local unprivileged access and is restricted to systems utilizing NVIDIA Tegra hardware architectures. Standard enterprise server deployments lacking these specific System-on-Chip processors do not expose the affected driver. On relevant embedded hardware, a local user interacting with the graphics device can trigger a memory management error, with the primary consequence being a system crash rather than arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.