Skip to main content

Linux Kernel AMDGPU EUVDEUVD-2026-55346

| CVE-2026-68245 HIGH
2026-08-10 Linux GHSA-j4xg-92j8-hcv5
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local vector confirmed by kernel driver context; low privilege matches standard GPU group membership; no scope change as impact is contained to the vulnerable kernel.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.8 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:27 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:01 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:01 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_irqrestore is called and returned, the pointer is no longer under lock and is subject to modification. Since, the caller still dereferences vm->task_info in amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a use after unlock problem.

Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() through removing the amdgpu_vm_get_vm_from_pasid() function from amdgpu_vm.c and making the relevant code inline to hold the lock while it is still in use.

(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)

AnalysisAI

Use-after-unlock memory corruption in the Linux kernel's DRM/AMDGPU driver allows local low-privileged users on systems with AMD GPUs to read or corrupt kernel memory via the amdgpu_vm_get_task_info_pasid() function. The defect stems from a lock lifetime design flaw: a vm pointer obtained under XArray lock is dereferenced after xa_unlock_irqrestore releases that lock, leaving the pointer unprotected against concurrent modification. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), but the CVSS-rated impact is High across Confidentiality, Integrity, and Availability, and vendor patches are available across multiple stable branches.

Technical ContextAI

The vulnerability resides in drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c within the Linux kernel's Direct Rendering Manager (DRM) AMDGPU subsystem. The root cause is a lock lifetime error: amdgpu_vm_get_vm_from_pasid() returns a pointer to an amdgpu_vm structure that is only valid while an XArray (xa) lock is held. After xa_unlock_irqrestore() releases the lock and returns, concurrent kernel threads (e.g., GPU memory management, process teardown) may modify or free the vm structure. The caller then dereferences vm->task_info in amdgpu_vm_get_task_info_vm() without holding the lock - a classic use-after-unlock, analogous to use-after-free in impact. The fix inlines the previously separate amdgpu_vm_get_vm_from_pasid() logic so the lock is held continuously while the vm pointer is in use. CPE cpe:2.3:a:linux:linux confirms this affects the mainline Linux kernel. No CWE was assigned by NVD, but this maps to CWE-667 (Improper Locking) combined with CWE-416-class memory safety concerns arising from concurrent access without proper lifetime management.

RemediationAI

Update the Linux kernel to a patched stable release: 6.12.101, 6.18.42, or 7.1.6, or apply the upstream cherry-pick commit 9d01579f3f868b333acc901815972685989092c7. Stable-branch patches are available at https://git.kernel.org/stable/c/fe16a7e5336ae888751984e30c451fbf7cfa5df7 (6.18.x), https://git.kernel.org/stable/c/04cc4aa3617b0ed67e859f91f09de5d896a46f3a (6.12.x), https://git.kernel.org/stable/c/5d5fb9124a2bba96a7807086d8fe0f7ce810d546, and https://git.kernel.org/stable/c/1173190412fb9d12e7efce76734118d9712ff970. Distributions shipping kernel packages (RHEL, Ubuntu, SUSE, Debian) should be monitored for downstream package updates. If immediate patching is not possible, a compensating control is to restrict GPU VM access by removing untrusted local users from the video or render groups, limiting their ability to trigger AMDGPU VM PASID lookups. Note this workaround may interfere with legitimate GPU workloads for affected users. Blacklisting the AMDGPU driver (amdgpu.modeset=0 or adding blacklist amdgpu to /etc/modprobe.d/) on non-GPU systems is a stronger but disruptive mitigation.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55346 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy