Description
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix context pstate override handling

There are several problems in the context pstate handling code.

The most serious ones are potential use-after-free and NULL pointer
dereferences at context initialization time. Both are due
amdgpu_ctx_init() not holding the adev->pm.stable_pstate_ctx_lock, which
is otherwise used from both sysfs and the context code itself for
modifying and clearing the stored context pointer.

Second issue is that context fini can trample over the pstate
configuration set via sysfs. This is due the restore state
(ctx->stable_pstate) being saved at context init time, and not if, or when
the context actually changes the pstate. As the context exits it will
therefore incorrectly restore to what was set before the sysfs override
was requested.

The simplest fix is to drastically simplify how the state is tracked, by
clearly defining the points at which pstate ownership is taken and
released, and to handle all transitions under the correct lock.

Instead of at context init time, the previous state is saved only at the
point the context overrides the current state, and is restored on context
exit only if the context is still the owner of the current override state.

(cherry picked from commit 1b5e413713c0a93bc1818394d0ce49aaad21bd27)
Published: 2026-08-10
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improper handling of context persistent state during initialization of the AMDGPU driver in the Linux kernel. The code fails to acquire the required lock when storing or clearing the context pointer, creating use‑after‑free and NULL pointer dereference conditions. These faults can destabilize the kernel when a GPU context is created, potentially causing a crash or service interruption.

Affected Systems

All Linux kernel versions that include the AMDGPU driver before the commit 1b5e4137 are affected. Systems that load the amdgpu module and create graphic contexts, particularly those allowing local users to run GPU workloads, may experience the issue.

Risk and Exploitability

The flaw resides in kernel‑mode code that can be triggered by a local user with GPU access. Because the vulnerability manifests as kernel crashes or memory corruption, the risk is moderate; it may result in denial of service but does not appear to provide direct privilege escalation according to the supplied description. EPSS information is not available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is local exploitation of the GPU driver by a user with the ability to create contexts.

Generated by OpenCVE AI on August 10, 2026 at 19:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a release that includes the commit 1b5e4137, which contains the fix for the pstate handling in the AMDGPU driver.
  • If an immediate kernel upgrade is not feasible, restrict GPU access by disabling the amdgpu driver or limiting which users can load the module, thereby preventing accidental exploitation of the fault.
  • If patching cannot be applied immediately, apply the specific commit manually from source or use a live kernel patching tool until a stable release is available.

Generated by OpenCVE AI on August 10, 2026 at 19:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-476

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Both are due amdgpu_ctx_init() not holding the adev->pm.stable_pstate_ctx_lock, which is otherwise used from both sysfs and the context code itself for modifying and clearing the stored context pointer. Second issue is that context fini can trample over the pstate configuration set via sysfs. This is due the restore state (ctx->stable_pstate) being saved at context init time, and not if, or when the context actually changes the pstate. As the context exits it will therefore incorrectly restore to what was set before the sysfs override was requested. The simplest fix is to drastically simplify how the state is tracked, by clearly defining the points at which pstate ownership is taken and released, and to handle all transitions under the correct lock. Instead of at context init time, the previous state is saved only at the point the context overrides the current state, and is restored on context exit only if the context is still the owner of the current override state. (cherry picked from commit 1b5e413713c0a93bc1818394d0ce49aaad21bd27)
Title drm/amdgpu: Fix context pstate override handling
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-10T12:01:48.734Z

Reserved: 2026-07-30T09:28:09.379Z

Link: CVE-2026-68273

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T21:00:03Z

Weaknesses