Skip to main content

Linux Kernel EUVDEUVD-2026-59643

| CVE-2026-74450 HIGH
2026-08-15 Linux GHSA-w7rg-pqcq-fh8p
Amd Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition exploitation requires precise kernel scheduling timing, warranting AC:H over AC:L; PR:L reflects minimum local user access needed to trigger concurrent sysfs operations.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 11:30 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
CVE Published
Aug 15, 2026 - 12:26 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 12:26 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix pptable use-after-free

amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free.

Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer.

(cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)

AnalysisAI

Use-after-free in the Linux kernel's AMD GPU power management subsystem (drm/amd/pm) allows a low-privileged local attacker to corrupt kernel memory via a race condition in the sysfs power table interface. The flaw exists because amdgpu_dpm_get_pp_table() returns a raw pointer to a driver-owned buffer after releasing adev->pm.mutex, enabling a concurrent pp_table write to free the allocation while a sysfs copy is still in progress. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain low-privilege local shell access
Delivery
Locate AMD GPU sysfs pp_table attribute path
Exploit
Spawn concurrent reader and writer threads targeting pp_table
Execution
Win race condition causing kernel to free pp_table buffer mid-copy
Persist
Dereference freed pointer in kernel context
Impact
Exploit memory corruption primitive for local privilege escalation
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) local shell access with at least low-privilege user credentials, consistent with CVSS PR:L; (2) an AMD GPU physically installed in the target system with the amdgpu kernel driver actively loaded - systems using NVIDIA, Intel, or software rendering are entirely unaffected; (3) access to the pp_table sysfs attribute under /sys/class/drm/, which is typically world-readable on default Linux configurations, though triggering the write side of the race may require elevated privileges or permissive sysfs ACL configuration depending on distribution defaults; and (4) ability to execute concurrent read and write operations on the pp_table interface to win the kernel scheduling race window. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact if exploitation succeeds, with only low-privilege local access required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local user with a standard unprivileged shell account on an AMD GPU-equipped Linux system spawns two concurrent threads: one repeatedly reading the pp_table sysfs attribute and another writing to it, creating a tight race to free the kernel buffer mid-copy. If the race is won, the kernel dereferences a freed pointer, potentially yielding a kernel memory read/write primitive that can be leveraged for local privilege escalation to root. …
Remediation Update the Linux kernel to version 7.1.8 or 7.2-rc6 or later, which incorporate the upstream fixes published at https://git.kernel.org/stable/c/b628f2c6feb3a115ea72d3120a2bd94afc5163df and https://git.kernel.org/stable/c/bb493058c35c8676e48269ab6732688ea733d23c. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory Linux systems with AMD GPUs and confirm vulnerability applicability by checking kernel version against AMD amdgpu driver release notes; identify mission-critical systems requiring GPU acceleration. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2023-1048 HIGH POC
7.8 Feb 26

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59643 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy