Skip to main content

Linux Kernel CVE-2025-68793

HIGH
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local GPU-submit access gives PR:L and AV:L; the timing race raises AC to H; kernel-memory UAF supports high C/I/A within an unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 07:22 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:22 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix a job->pasid access race in gpu recovery

Avoid a possible UAF in GPU recovery due to a race between the sched timeout callback and the tdr work queue.

The gpu recovery function calls drm_sched_stop() and later drm_sched_start(). drm_sched_start() restarts the tdr queue which will eventually free the job. If the tdr queue frees the job before time out callback completes, the job will be freed and we'll get a UAF when accessing the pasid. Cache it early to avoid the UAF.

Example KASAN trace: [ 493.058141] BUG: KASAN: slab-use-after-free in amdgpu_device_gpu_recover+0x968/0x990 [amdgpu] [ 493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323 [ 493.074892] [ 493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G E 6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary) [ 493.076493] Tainted: [E]=UNSIGNED_MODULE [ 493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019 [ 493.076500] Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched] [ 493.076512] Call Trace: [ 493.076515] <TASK> [ 493.076518] dump_stack_lvl+0x64/0x80 [ 493.076529] print_report+0xce/0x630 [ 493.076536] ? _raw_spin_lock_irqsave+0x86/0xd0 [ 493.076541] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 493.076545] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu] [ 493.077253] kasan_report+0xb8/0xf0 [ 493.077258] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu] [ 493.077965] amdgpu_device_gpu_recover+0x968/0x990 [amdgpu] [ 493.078672] ? __pfx_amdgpu_device_gpu_recover+0x10/0x10 [amdgpu] [ 493.079378] ? amdgpu_coredump+0x1fd/0x4c0 [amdgpu] [ 493.080111] amdgpu_job_timedout+0x642/0x1400 [amdgpu] [ 493.080903] ? pick_task_fair+0x24e/0x330 [ 493.080910] ? __pfx_amdgpu_job_timedout+0x10/0x10 [amdgpu] [ 493.081702] ? _raw_spin_lock+0x75/0xc0 [ 493.081708] ? __pfx__raw_spin_lock+0x10/0x10 [ 493.081712] drm_sched_job_timedout+0x1b0/0x4b0 [gpu_sched] [ 493.081721] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 493.081725] process_one_work+0x679/0xff0 [ 493.081732] worker_thread+0x6ce/0xfd0 [ 493.081736] ? __pfx_worker_thread+0x10/0x10 [ 493.081739] kthread+0x376/0x730 [ 493.081744] ? __pfx_kthread+0x10/0x10 [ 493.081748] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 493.081751] ? __pfx_kthread+0x10/0x10 [ 493.081755] ret_from_fork+0x247/0x330 [ 493.081761] ? __pfx_kthread+0x10/0x10 [ 493.081764] ret_from_fork_asm+0x1a/0x30 [ 493.081771] </TASK>

(cherry picked from commit 20880a3fd5dd7bca1a079534cf6596bda92e107d)

AnalysisAI

Local privilege escalation or kernel memory disclosure in the Linux kernel's amdgpu DRM driver stems from a use-after-free during GPU recovery, where a race between the scheduler timeout callback (drm_sched_job_timedout) and the TDR work queue can free a job structure before amdgpu_device_gpu_recover reads its pasid field. Affected systems are those running vulnerable kernels with AMD GPUs using the amdgpu driver; a local attacker able to submit GPU work and induce a GPU hang could trigger the freed-memory access, as demonstrated by the supplied KASAN slab-use-after-free trace. There is no public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 7th percentile), consistent with a difficult-to-win kernel race rather than a broadly exploited flaw.

Technical ContextAI

The flaw lives in the amdgpu kernel-mode driver's GPU reset/recovery path, which cooperates with the shared DRM GPU scheduler (gpu_sched). During recovery, amdgpu_device_gpu_recover() calls drm_sched_stop() and later drm_sched_start(); the restart re-arms the timeout/TDR (timeout detection and recovery) work queue, which is responsible for eventually freeing the timed-out job object. Because the timeout callback still dereferences job->pasid after drm_sched_start() may have already caused the TDR queue to free that job, the code reads memory that has been returned to the slab allocator. The root cause class is CWE-416 (Use After Free), specifically a concurrency/lifetime race on the job structure; the CVE input lists CWE as N/A, so the classification is inferred from the description. The fix caches the pasid value early (before the window in which the job can be freed), removing the dangling dereference - a standard read-before-free lifetime fix.

Affected ProductsAI

The affected component is the Linux kernel's amdgpu DRM driver, impacting hosts with AMD GPUs that load the amdgpu module. Exact vulnerable version ranges are not enumerated in the provided data (no CPE strings supplied); the KASAN trace was captured on kernel 6.16.0, and the fix is a cherry-pick of upstream commit 20880a3fd5dd7bca1a079534cf6596bda92e107d. Stable-tree fixes are referenced at git.kernel.org commits 77f73253015cbc7893fca1821ac3eae9eb4bc943 and dac58c012c47cadf337a35eb05d44498c43e5cd0. Distribution-specific exposure for Ubuntu is tracked in USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1), with additional advisory context at VulDB (https://vuldb.com/?id.340641).

RemediationAI

Apply the vendor/distribution kernel update that incorporates the upstream fix (Patch available per vendor advisory; the fix corresponds to mainline commit 20880a3fd5dd7bca1a079534cf6596bda92e107d and stable commits 77f73253015cbc7893fca1821ac3eae9eb4bc943 and dac58c012c47cadf337a35eb05d44498c43e5cd0). Ubuntu users should update per USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and reboot into the patched kernel; other distributions should track their equivalent kernel errata. Because the fix is a small lifetime correction with no configuration toggle, patching is the only complete remediation - no functional workaround disables the vulnerable path without disabling GPU use. As an interim compensating control on multi-user or untrusted-local systems, restrict local access and limit which users can submit GPU workloads (e.g., tighten access to /dev/dri render nodes and avoid exposing the GPU to untrusted containers/VMs), accepting that this reduces GPU availability for those users; on servers that do not need AMD graphics, not loading the amdgpu module eliminates exposure at the cost of losing AMD GPU functionality.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68793 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy