CVE-2026-68107

The upstream fix for this TOCTOU vulnerability in the AMDGPU VCN4 IB parsing code predates the CVE assignment by an unknown window. That timing inversion is the real story — the technical vulnerability is straightforward (a redundant read of IB param length creating a race condition), but the remediation gap that matters is not disclosure-to-fix, it's CVE-to-vendor-backport. Vendors don't monitor upstream git commits; they monitor CVEs. If dbb02b4755f8 landed in upstream trees without a CVE, the exposure clock for vendor-distributed kernels never started counting until this disclosure forced recognition. The cherry-pick from upstream commit dbb02b4755f8 landed in stable, but the question is which vendor kernels have actually received it. AMDGPU sits in a peculiar space: shipped by multiple vendors with their own update cycles, some running out-of-tree driver forks that may never see this commit. The CVSS of 8.8 assumes successful exploitation, but the commit history across AMDGPU, i915, and VCN shows developers have consistently treated these TOCTOU patterns as worth fixing rather than theoretical — the race window in GPU command submission pipelines is apparently reliable enough in practice. The blast radius concern extends beyond this single CVE. The fix pattern (cache the return value and reuse it) is mechanically obvious, which raises the question of how many other VCN versions (VCN1, VCN2, VCN3, VCN5) share the identical redundant-read pattern but haven't been independently patched or audited. If a researcher traced dbb02b4755f8 backwards across the driver family, simultaneous disclosures could emerge. Action steps: verify your kernel version's backport status against the stable commit; confirm whether your vendor's AMDGPU driver fork has received this fix (don't assume upstream propagation equals vendor propagation); and audit the IB parsing path in other VCN generations if you maintain downstream GPU code. The vulnerability is simple, but the exposure window is defined by backport lag, not bug complexity.

Reviewed through automated stages and approved by a human before publication.