CVE-2026-68245 (GCVE-0-2026-68245)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-08-18 06:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only
valid while the lock is still being held. Once xa_unlock_irqrestore is
called and returned, the pointer is no longer under lock and is subject
to modification. Since, the caller still dereferences vm->task_info in
amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a
use after unlock problem.
Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid()
through removing the amdgpu_vm_get_vm_from_pasid() function from
amdgpu_vm.c and making the relevant code inline to hold the lock while
it is still in use.
(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fe16a7e5336ae888751984e30c451fbf7cfa5df7",
"status": "affected",
"version": "b8f67b9ddf4f8fe6dd536590712b5912ad78f99c",
"versionType": "git"
},
{
"lessThan": "1173190412fb9d12e7efce76734118d9712ff970",
"status": "affected",
"version": "b8f67b9ddf4f8fe6dd536590712b5912ad78f99c",
"versionType": "git"
},
{
"lessThan": "5d5fb9124a2bba96a7807086d8fe0f7ce810d546",
"status": "affected",
"version": "b8f67b9ddf4f8fe6dd536590712b5912ad78f99c",
"versionType": "git"
},
{
"lessThan": "04cc4aa3617b0ed67e859f91f09de5d896a46f3a",
"status": "affected",
"version": "b8f67b9ddf4f8fe6dd536590712b5912ad78f99c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()\n\nThe vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only\nvalid while the lock is still being held. Once xa_unlock_irqrestore is\ncalled and returned, the pointer is no longer under lock and is subject\nto modification. Since, the caller still dereferences vm-\u003etask_info in\namdgpu_vm_get_task_info_vm() after the lock is removed, this causes a\nuse after unlock problem.\n\nRemove the lifetime issue present in amdgpu_vm_get_task_info_pasid()\nthrough removing the amdgpu_vm_get_vm_from_pasid() function from\namdgpu_vm.c and making the relevant code inline to hold the lock while\nit is still in use.\n\n(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through the amdgpu DRM device (render node) via command submission causing a GPU VM page fault or a ring timeout; this requires local access to /dev/dri/renderD*, with no network exposure.\nAC:L - The attacker controls both sides of the race: it can generate GPU page faults or job timeouts at will while concurrently closing DRM file descriptors to free the amdgpu_vm/fpriv, and can retry the race arbitrarily many times until it wins.\nPR:L - Only an unprivileged local account with access to the AMD GPU render node is needed; render nodes are world/group accessible by default on desktop, Android and container workloads, and no capability is checked on the CS/fault path.\nUI:N - The attacker\u0027s own processes generate the GPU faults and the concurrent VM teardown; no action by any other user is required.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 the freed amdgpu_vm/amdgpu_task_info are kernel heap objects, with no crossing of a VM or IOMMU boundary.\nC:H - The stale vm pointer is dereferenced after free, reading vm-\u003etask_info out of reallocated kernel heap memory, and the resulting task_info contents (process name, pid, tgid) are then printed/exported, allowing disclosure of attacker-groomed or unrelated kernel data.\nI:H - kref_get() is performed on memory that may already be freed and reallocated, writing an increment into another object\u0027s fields, and the paired kref_put() can drop a foreign refcount to zero \u2014 a classic use-after-free/refcount-corruption primitive leveraged for arbitrary write and privilege escalation.\nA:H - The use-after-free occurs in a GPU interrupt handler and the reset/timeout path; dereferencing freed memory or corrupting a reused slab object readily oopses or panics the kernel, and it can be retriggered repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T06:55:46.886Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fe16a7e5336ae888751984e30c451fbf7cfa5df7"
},
{
"url": "https://git.kernel.org/stable/c/1173190412fb9d12e7efce76734118d9712ff970"
},
{
"url": "https://git.kernel.org/stable/c/5d5fb9124a2bba96a7807086d8fe0f7ce810d546"
},
{
"url": "https://git.kernel.org/stable/c/04cc4aa3617b0ed67e859f91f09de5d896a46f3a"
}
],
"title": "drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68245",
"datePublished": "2026-08-10T12:01:11.501Z",
"dateReserved": "2026-07-30T09:28:09.377Z",
"dateUpdated": "2026-08-18T06:55:46.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…