CVE-2026-68260

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/imagination: acquire vm_ctx-&gt;lock before mapping memory to GPU VM<br /> <br /> The drm gpuvm code doesn&amp;#39;t protect find operation against map operation,<br /> and the driver needs to ensure a map operation shouldn&amp;#39;t happen when a<br /> find operation is in progress.<br /> <br /> In some cases a find operation will be in progress when doing map/unmap<br /> operations, and the find operation will do a NULL pointer dereference.<br /> <br /> An example of the stack trace of such NULL dereference is shown below:<br /> <br /> ```<br /> Unable to handle kernel access to user memory without uaccess routines at<br /> virtual address 0000000000000010<br /> <br /> [] drm_gpuva_find+0x28/0x6c [drm_gpuvm]<br /> [] pvr_vm_unmap+0x34/0x68 [powervr]<br /> [] pvr_ioctl_vm_unmap+0x2e/0x50 [powervr]<br /> [] drm_ioctl_kernel+0x8e/0xdc<br /> [] drm_ioctl+0x1be/0x3e0<br /> [] __riscv_sys_ioctl+0xba/0xc4<br /> [] do_trap_ecall_u+0x23e/0x3f4<br /> [] handle_exception+0x168/0x174<br /> ```<br /> <br /> As all occurences of drm_gpuva_find*() are already guarded by<br /> vm_ctx-&gt;lock, make pvr_vm_map() to acquire this lock to prevent<br /> disturbing any find operation. This fixes the NULL deference problem in<br /> drm_gpuva_find*().