CVE-2026-68261

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: fix error checking of pvr_vm_context_lookup()

Since pvr_vm_context_lookup() returns either NULL or a pointer, then stop

using IS_ERR() for checking the return value.

Using IS_ERR() leads to the kernel oops reported below. It can be

reproduced by passing an invalid VM context handle from userspace to the

DRM_IOCTL_PVR_CREATE_CONTEXT ioctl.

[ 92.733119] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000148

[ 92.742042] Mem abort info:

[ 92.744890] ESR = 0x0000000096000004

[ 92.748686] EC = 0x25: DABT (current EL), IL = 32 bits

[ 92.754020] SET = 0, FnV = 0

[ 92.757154] EA = 0, S1PTW = 0

[ 92.760337] FSC = 0x04: level 0 translation fault

[ 92.765243] Data abort info:

[ 92.768129] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000

[ 92.773626] CM = 0, WnR = 0, TnD = 0, TagAccess = 0

[ 92.778763] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0

[

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References