Executive brief
The Linux kernel's GPU host1x driver contains an error-handling bug in the pin_job() function that incorrectly checks the return value from iommu_map_sgtable(). This could allow invalid IOMMU mapping operations to succeed or fail silently, potentially leading to memory access violations or system crashes when graphics jobs are executed.
Technical details
The vulnerability exists in drivers/gpu/host1x/job.c where the pin_job() function was incorrectly checking the return value of iommu_map_sgtable(). After a prior API change (commit ad8f36e4b6b1), iommu_map_sgtable() was changed to return an ssize_t with negative error codes instead of size_t with zero for errors. The pin_job() function was assigning the return value to an 'int' variable and checking if it equals zero, which fails to detect actual error conditions and can cause integer overflows. The fix introduces a separate ssize_t variable (map_err) to properly capture the return value and checks for negative values using (map_err < 0). This is a local logic error in GPU driver code; exploitation requires local access and knowledge of the host1x subsystem.
Affected products
- Linux Linux Kernel multiple versions (see kernel.git history)
Timeline
- 2026-08-15: disclosed
- 2026-04-21: patched: Fix committed upstream