Linux i915 GPU kernel driver (context SSEU parameter): NULL dereference reachable by setting a context engine slot

Impact

NULL dereference reachable by setting a context engine slot to an invalid engine class and then querying the SSEU context parameter. A tenant can panic the GPU node from an ordinary unprivileged ioctl sequence.

Who can reach it

Any local user or container with a DRM render node - i.e. any tenant that was scheduled a GPU. No privileged capability needed.

What to do

Fix ships in the Linux kernel. Update the kernel and reboot the node - in practice this is a drain plus reboot because the accelerator driver cannot be unloaded while jobs hold device file descriptors. No BIOS or firmware update needed.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2026-68259 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Unscored
• Linux kernel Intel IOMMU: out-of-bounds memset in dmar_latency_disable() corrupts adjacent memoryCVE-2026-68324 · Linux kernel Intel IOMMU (dmar_latency_disable)Unscored
• Linux kernel BPF sockmap: unhashed UDP sockets leak socket refcounts, exhausting host memoryCVE-2026-68386 · Linux kernel BPF sockmap (UDP socket refcount on map update)Unscored
• Linux kernel KVM x86 MMU: use-after-free when a vendor module is reloaded after a failed initCVE-2026-68428 · Linux kernel KVM x86 MMU (mmu_destroy_caches)Unscored
• Linux perf/x86/amd/brs - kernel address leakage through Branch Sampling: A user-only branch stack collected via AMDCVE-2026-72237 · Linux perf/x86/amd/brs - kernel address leakage through Branch SamplingUnscored
• Linux BPF verifier: kernel pointers leak through verifier logs for three pseudo ldimm64 sourcesCVE-2026-72402 · Linux kernel BPF verifier (ldimm64 pseudo-pointer masking in verifier logs)Unscored