{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68984", "assignerOrgId": "a8bfbd5c-5645-475e-a8f4-6c140c17bd29", "state": "PUBLISHED", "assignerShortName": "samsungsemiconductor", "dateReserved": "2026-08-03T06:35:58.535Z", "datePublished": "2026-11-05T02:41:23.587Z", "dateUpdated": "2026-11-10T13:52:51.530Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-190", "description": "CWE-190", "type": "CWE"}]}], "affected": [{"vendor": "Samsung Semiconductor", "product": "Exynos 2100", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}, {"vendor": "Samsung Semiconductor", "product": "Exynos 1280", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}, {"vendor": "Samsung Semiconductor", "product": "Exynos 2200", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}, {"vendor": "Samsung Semiconductor", "product": "Exynos 1380", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}, {"vendor": "Samsung Semiconductor", "product": "Exynos 1480", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}, {"vendor": "Samsung Semiconductor", "product": "Exynos 2400", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}, {"vendor": "Samsung Semiconductor", "product": "Exynos 1580", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}, {"vendor": "Samsung Semiconductor", "product": "Exynos 2500", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}, {"vendor": "Samsung Semiconductor", "product": "Exynos 2600", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}, {"vendor": "Samsung Semiconductor", "product": "Exynos 1680", "versions": [{"status": "affected", "version": "0", "lessThan": "November 2026", "versionType": "date"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: rgb(255, 255, 255);\">In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.</span>"}]}], "references": [{"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/"}], "providerMetadata": {"orgId": "a8bfbd5c-5645-475e-a8f4-6c140c17bd29", "shortName": "samsungsemiconductor", "dateUpdated": "2026-11-05T02:41:23.587Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T13:52:34.434135Z", "id": "CVE-2026-68984", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T13:52:51.530Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Exynos 2100", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "product": "Exynos 1280", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "product": "Exynos 2200", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "product": "Exynos 1380", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "product": "Exynos 1480", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "product": "Exynos 2400", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "product": "Exynos 1580", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "product": "Exynos 2500", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "product": "Exynos 2600", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}, {"defaultStatus": "unaffected", "product": "Exynos 1680", "vendor": "Samsung Semiconductor", "versions": [{"lessThan": "November 2026", "status": "affected", "version": "0", "versionType": "date"}]}], "source": "a8bfbd5c-5645-475e-a8f4-6c140c17bd29"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption."}], "id": "CVE-2026-68984", "lastModified": "2026-11-10T14:17:33.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68984", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T13:52:34.434135Z", "version": "2.0.3"}}]}, "published": "2026-11-05T03:17:31.133", "references": [{"source": "a8bfbd5c-5645-475e-a8f4-6c140c17bd29", "url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/"}], "sourceIdentifier": "a8bfbd5c-5645-475e-a8f4-6c140c17bd29", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "a8bfbd5c-5645-475e-a8f4-6c140c17bd29", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: kernel: Memory corruption via integer overflow in Samsung Exynos NPU driver", "id": "2567666", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567666"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.", "A flaw was found in the Samsung Exynos Neural Processing Unit (NPU) kernel driver. An integer overflow allows an unprivileged local application to trigger memory corruption within the kernel. This issue could lead to a system crash, resulting in a denial of service (DoS), or potentially allow an attacker to gain elevated privileges."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to trap integer wraparounds before corrupted sizes reach allocation or copying logic in the Samsung Exynos NPU kernel driver: upgrade to the corresponding fixed Red Hat builds, which vendor patch details are not specified in the advisory, closing crafted driver invocation triggering integer overflow. Until patched, this is only a concern on Linux systems on affected Samsung Exynos SoCs with local unprivileged code execution \u2014 Red Hat Enterprise Linux and hardware lacking Samsung Exynos SoCs are unaffected \u2014 so Restrict local unprivileged user access to the Samsung Exynos NPU driver device node and limit local unprivileged execution. As a compensating measure, Enable runtime memory error detection with KASAN or HWASan to catch out-of-bounds access and heap corruption, Enable KASLR to randomize kernel base addresses and obstruct code reuse attacks, Enable SMEP to block the kernel from executing code in userspace memory, Enable SMAP to prevent direct kernel access to userspace memory during driver calls, Enforce kernel forward and backward edge Control Flow Integrity to prevent control-flow hijacking via corrupted function pointers, and Enable SLAB freelist hardening and randomization to prevent freelist corruption and heap metadata tampering. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)"}, "name": "CVE-2026-68984", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libkrun", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-05T02:41:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68984\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68984\nhttps://semiconductor.samsung.com/support/quality-support/product-security-updates/"], "statement": "This vulnerability is rated as having an Important impact because a local, unprivileged user could induce kernel memory corruption, potentially leading to privilege escalation or a denial of service. However, exploitation requires underlying Samsung Exynos system-on-chip hardware. Red Hat Enterprise Linux does not include or support drivers for this hardware platform, so supported Red Hat configurations are not exposed.", "threat_severity": "Important"}