CVE-2026-68103

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: reject mapping a reserved doorbell to a new queue<br /> <br /> When creating an user-queue, the user space<br /> provides a doorbell BO handle and an offset within<br /> the bo to obtain a doorbell.<br /> <br /> However current implementation using xa_store_irq()<br /> to store a doorbell, which allows a later queue created<br /> with the same BO and offset parameters to overwrite an<br /> existing queue and doorbell mapping.<br /> <br /> This can cause problems like misrouting fence IRQ<br /> processing to a wrong queue, and mislead the cleanup<br /> process of one queue erasing the mapping of another queue.<br /> <br /> This commit fixes this issue by replacing xa_store_irq with<br /> xa_insert_irq, which rejects mapping a reserved<br /> doorbell to a newly created queue<br /> <br /> (cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e)