CVE-2026-68104 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
Call pm_genpd_remove() to unregister from global list prior to releasing acp_genpd memory, and clear the pointer after free.
(cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the amdgpu driver subsystem of the linux kernel and represents a memory management issue that could potentially lead to system instability or security concerns. The problem specifically occurs during the cleanup process of power management generic power domains when the driver is being unloaded or during device removal operations. The flaw stems from an improper sequence of operations where the power management generic power domain structure is freed before it is properly unregistered from the global power management domain list.
The technical implementation involves the drm/amdgpu subsystem which manages graphics hardware for AMD GPUs through the direct rendering manager framework. When the driver needs to clean up resources associated with a generic power domain, it fails to invoke pm_genpd_remove() function before proceeding to free the acp_genpd memory structure. This sequence violation creates a potential race condition or dangling pointer scenario where references to the freed memory may still exist in the global power management domain tracking system.
According to CWE classification, this vulnerability aligns with CWE-415: Double Free and CWE-416: Use After Free, as the improper ordering could lead to memory corruption when the system attempts to access or manipulate freed power domain structures. The vulnerability impacts the kernel's power management subsystem and could potentially affect any system utilizing AMD graphics hardware through the amdgpu driver.
The operational impact of this vulnerability extends beyond simple memory corruption, as it represents a potential pathway for privilege escalation or denial of service conditions. When the freed memory is accessed after removal from the global list but before actual freeing occurs, the kernel may exhibit undefined behavior including system crashes, data corruption, or in worst-case scenarios, arbitrary code execution. This risk is particularly elevated during system shutdown sequences or when multiple concurrent power management operations occur.
The fix implemented addresses this by ensuring proper ordering of operations where pm_genpd_remove() is called to unregister the power domain from the global tracking list before any memory freeing occurs. This approach follows established kernel development practices for resource cleanup and prevents the scenario where freed memory references persist in system-wide tracking structures. The cherry-pick from commit cd8650d7a91ee8b768e202354672553faa5cc1f2 indicates this fix has been properly integrated into the kernel's stable branches and follows the ATT&CK framework's defensive techniques for system integrity protection. Organizations should apply this patch to prevent potential exploitation of memory management vulnerabilities in systems running affected kernel versions, particularly those with AMD graphics hardware where the amdgpu driver is actively utilized.