Linux Kernel CVE-2026-74450

Exploitation requires: (1) local shell access with at least low-privilege user credentials, consistent with CVSS PR:L; (2) an AMD GPU physically installed in the target system with the amdgpu kernel driver actively loaded - systems using NVIDIA, Intel, or software rendering are entirely unaffected; (3) access to the pp_table sysfs attribute under /sys/class/drm/, which is typically world-readable on default Linux configurations, though triggering the write side of the race may require elevated privileges or permissive sysfs ACL configuration depending on distribution defaults; and (4) ability to execute concurrent read and write operations on the pp_table interface to win the kernel scheduling race window. Remote exploitation is not possible (CVSS AV:L). Single-user systems with no untrusted local accounts, systems where amdgpu is denylisted or not loaded, and container environments without /sys passthrough face negligible practical exposure.

The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact if exploitation succeeds, with only low-privilege local access required. Independent assessment suggests AC:H is more accurate for a race condition that depends on precise timing to win the kernel scheduling window, which would yield approximately 7.0 - this discrepancy should be noted when prioritizing against other 7.x findings. The EPSS score of 0.15% (5th percentile) is consistent with the absence of a CISA KEV listing and no known public POC, indicating no observed opportunistic exploitation to date. Even a mid-sized municipal IT team in rybnik managing AMD GPU workstations should treat this as a routine patching priority rather than an emergency response item, given the local-only attack vector and absence of weaponized tooling. The high C/I/A impact triplet is plausible for a kernel-space use-after-free that can yield arbitrary read/write primitives, and multi-user Linux systems or shared compute environments where untrusted users hold shell access represent the realistic high-risk deployment context.

A local user with a standard unprivileged shell account on an AMD GPU-equipped Linux system spawns two concurrent threads: one repeatedly reading the pp_table sysfs attribute and another writing to it, creating a tight race to free the kernel buffer mid-copy. If the race is won, the kernel dereferences a freed pointer, potentially yielding a kernel memory read/write primitive that can be leveraged for local privilege escalation to root. No public proof-of-concept exploit code has been identified at time of analysis.