CVE-2026-68102

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix aperture mapping leak

amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver

fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to

always return false, so iounmap(aper_base_kaddr) never runs on normal

driver unload, leaving an orphaned entry in the x86 PAT interval tree.

On connected_to_cpu hardware, the aperture is mapped write-back (WB) via

ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC)

over the same range. The WC vs WB conflict causes:

ioremap error for 0x..., requested 0x1, got 0x0

amdgpu: discovery failed: -2

Fix by switching to devres-managed mappings so cleanup is guaranteed

regardless of drm_dev_enter() state:

- connected_to_cpu path: devm_memremap(MEMREMAP_WB). For

IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut,

returning __va(offset) from the existing kernel direct map. No new

ioremap VA or PAT entry i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References