CVE-2026-68984
Description
A flaw was found in the Samsung Exynos Neural Processing Unit (NPU) kernel driver. An integer overflow allows an unprivileged local application to trigger memory corruption within the kernel. This issue could lead to a system crash, resulting in a denial of service (DoS), or potentially allow an attacker to gain elevated privileges.
Statement
This vulnerability is rated as having an Important impact because a local, unprivileged user could induce kernel memory corruption, potentially leading to privilege escalation or a denial of service. However, exploitation requires underlying Samsung Exynos system-on-chip hardware. Red Hat Enterprise Linux does not include or support drivers for this hardware platform, so supported Red Hat configurations are not exposed.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to trap integer wraparounds before corrupted sizes reach allocation or copying logic in the Samsung Exynos NPU kernel driver: upgrade to the corresponding fixed Red Hat builds, which vendor patch details are not specified in the advisory, closing crafted driver invocation triggering integer overflow. Until patched, this is only a concern on Linux systems on affected Samsung Exynos SoCs with local unprivileged code execution — Red Hat Enterprise Linux and hardware lacking Samsung Exynos SoCs are unaffected — so Restrict local unprivileged user access to the Samsung Exynos NPU driver device node and limit local unprivileged execution. As a compensating measure, Enable runtime memory error detection with KASAN or HWASan to catch out-of-bounds access and heap corruption, Enable KASLR to randomize kernel base addresses and obstruct code reuse attacks, Enable SMEP to block the kernel from executing code in userspace memory, Enable SMAP to prevent direct kernel access to userspace memory during driver calls, Enforce kernel forward and backward edge Control Flow Integrity to prevent control-flow hijacking via corrupted function pointers, and Enable SLAB freelist hardening and randomization to prevent freelist corruption and heap metadata tampering. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (Memory); DoS: Instability
This weakness can generally lead to undefined behavior and therefore crashes. When the calculated result is used for resource allocation, this weakness can cause too many (or too few) resources to be allocated, possibly enabling crashes if the product requests more resources than can be provided. If the calculated result involves time values, then the product might crash when it encounters a time that is less than the previously-calculated time.
Integrity
Technical Impact: Modify Memory
If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the overflow/wraparound results in other conditions such as buffer overflows, further memory corruption may occur.
Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism
This weakness can sometimes trigger buffer overflows, which can be used to execute arbitrary code. This is usually outside the scope of the product's implicit security policy.
Availability,Other
Technical Impact: Alter Execution Logic; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
If the overflow/wraparound occurs in a loop index variable, this could cause the loop to terminate at the wrong time - too early, too late, or not at all (i.e., infinite loops). With too many iterations, some loops could consume too many resources such as memory, file handles, etc., possibly leading to a crash or other DoS.
Access Control
Technical Impact: Bypass Protection Mechanism
If integer values are used in security-critical decisions, such as calculating quotas or allocation limits, integer overflows can be used to cause an incorrect security decision.
Access Control
Technical Impact: Bypass Protection Mechanism; DoS: Crash, Exit, or Restart
If integer values are used in time-based, security-critical decisions, such as calculating expiration times or determining whether an event occurs within a specific time or date range, to cause an incorrect security decision. The consequences could even include "self-DoS" if the overflow produces a time value that is not accounted for in protection mechanism logic [REF-1570].
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
