Linux Kernel EUVD-2026-55374

Exploitation requires: (1) local authenticated access to the system with a standard (non-root) user account, per CVSS PR:L; (2) an AMD GPU physically present in the system with the amdgpu kernel module loaded and active - systems without AMD GPU hardware or running with amdgpu blacklisted are entirely unaffected; (3) the attacking user must have access to AMD GPU DRM device nodes (typically /dev/dri/renderD* via the 'render' or 'video' group membership on most Linux distributions); (4) the primary use-after-free vector requires timing a context initialization concurrently with a sysfs pstate modification, imposing a practical race window constraint. Remote exploitation is not possible (AV:L). The secondary logic-error defect (incorrect pstate restore at context exit) does not require a race and may be triggerable more deterministically, but its impact is configuration corruption rather than memory unsafety. Systems where local users have no GPU access, or single-user workstations without untrusted local users, have negligible practical risk.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high-severity local memory corruption with full C/I/A impact, requiring only a standard user account. However, several factors bound real-world risk: EPSS of 0.18% at the 7th percentile indicates the security community does not currently observe widespread exploitation tooling or activity; no CISA KEV listing confirms no confirmed in-the-wild exploitation. The race condition nature of the primary defect introduces practical exploitation difficulty - AC:L in the official vector arguably understates this, as reliable triggering requires timing concurrent sysfs and context operations. The attack surface is further constrained by hardware dependency: only systems with AMD GPUs running the amdgpu kernel module are vulnerable. The net risk profile is: high severity if exploited on applicable hardware, but low current exploitation likelihood. Priority for patching should be elevated on multi-user Linux systems with AMD GPUs (workstations, GPU compute nodes, gaming platforms) where untrusted local users exist.

A local user with a standard shell account on a Linux workstation or GPU compute node with an AMD GPU races amdgpu_ctx_init() against a concurrent sysfs pstate write to /sys/class/drm/*/device/power_dpm_force_performance_level, triggering a use-after-free or NULL pointer dereference in kernel memory. Successful exploitation could allow the attacker to corrupt kernel heap memory structures, potentially escalating privileges to root, or reliably crashing the kernel (denial of service). No public exploit code has been identified at time of analysis.