Description
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only
valid while the lock is still being held. Once xa_unlock_irqrestore is
called and returned, the pointer is no longer under lock and is subject
to modification. Since, the caller still dereferences vm->task_info in
amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a
use after unlock problem.

Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid()
through removing the amdgpu_vm_get_vm_from_pasid() function from
amdgpu_vm.c and making the relevant code inline to hold the lock while
it is still in use.

(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)
Published: 2026-08-10
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Use‑After‑Unlock causing kernel memory corruption and potential privilege escalation
Action: Patch Now
AI Analysis

Impact

The AMDGPU driver returns a virtual memory context pointer that is only safe while a lock is held. After the lock is released, the driver continues to dereference vm->task_info, resulting in a use‑after‑unlock that can corrupt kernel memory and, if exploited, grant local privilege escalation. Based on the description, it is inferred that this condition could lead to local privilege escalation. This flaw exemplifies a race condition (CWE‑825) and concurrent execution issue (CWE‑362).

Affected Systems

All Linux kernel installations that contain the AMDGPU DRM module before commit 9d01579f3f868b333acc901815972685989092c7 are vulnerable. This includes every distribution kernel that ships an unpatched AMDGPU driver, regardless of vendor, and affects any systems utilizing AMD GPUs or GPU pass‑through setups.

Risk and Exploitability

The CVSS score of 7.8 classifies the flaw as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. Based on the description, it is inferred that the vulnerability requires local or compromise‑level access to trigger the race condition, and that local privilege escalation is a potential outcome. The vulnerability is not listed in CISA KEV. Nevertheless, the potential for kernel memory corruption and privilege escalation warrants immediate attention.

Generated by OpenCVE AI on October 20, 2026 at 10:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a kernel update that contains commit 9d01579f3f868b333acc901815972685989092c7 (or a newer equivalent) to eliminate the use‑after‑unlock flaw.
  • If a kernel update is unavailable, backport the fix by removing the amdgpu_vm_get_vm_from_pasid() function and inlining its logic while holding the lock, ensuring vm->task_info is accessed only under protection (addresses CWE‑825).
  • Disable the amdgpu kernel module or block all GPU passthrough functionality as a temporary measure until the underlying race condition can be remedied.
  • Monitor system logs for abnormal GPU or kernel memory errors that may indicate the vulnerability being exploited and be prepared to apply an emergency rebuild if symptoms appear.

Generated by OpenCVE AI on October 20, 2026 at 10:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4745-1 linux-6.12 security update
Ubuntu USN Ubuntu USN USN-8887-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8888-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8889-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-8887-2 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8888-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8887-3 Linux kernel vulnerabilities
History

Mon, 19 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 14 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Thu, 13 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}


Wed, 12 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate


Mon, 10 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_irqrestore is called and returned, the pointer is no longer under lock and is subject to modification. Since, the caller still dereferences vm->task_info in amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a use after unlock problem. Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() through removing the amdgpu_vm_get_vm_from_pasid() function from amdgpu_vm.c and making the relevant code inline to hold the lock while it is still in use. (cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)
Title drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-30T12:28:14.789Z

Reserved: 2026-07-30T09:28:09.377Z

Link: CVE-2026-68245

cve-icon Vulnrichment

Updated: 2026-10-16T15:46:08.221Z

cve-icon NVD

Status : Received

Published: 2026-08-10T13:20:12.960

Modified: 2026-10-30T13:19:42.287

Link: CVE-2026-68245

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68245 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T11:00:15Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-825

    Expired Pointer Dereference