CVE-2026-68245 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_irqrestore is called and returned, the pointer is no longer under lock and is subject to modification. Since, the caller still dereferences vm->task_info in amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a use after unlock problem.
Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() through removing the amdgpu_vm_get_vm_from_pasid() function from amdgpu_vm.c and making the relevant code inline to hold the lock while it is still in use.
(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in the Linux kernel's amdgpu driver represents a critical use after unlock condition that compromises system stability and security. This flaw exists within the drm/amdgpu subsystem where the function amdgpu_vm_get_task_info_pasid() fails to properly manage memory access patterns during concurrent operations. The root cause stems from improper handling of lock acquisition and release sequences, creating a temporal window where pointer references become invalid while still being dereferenced by subsequent code paths.
The technical implementation issue manifests when the vm pointer obtained through amdgpu_vm_get_vm_from_pasid() is subject to modification once the xa_unlock_irqrestore function completes its execution. This lock release operation creates a race condition where the memory location pointed to by vm becomes available for modification by other concurrent processes or kernel threads while the calling code continues to reference it. The problem specifically occurs in the sequence where amdgpu_vm_get_task_info_pasid() retrieves a virtual machine pointer, releases the lock through xa_unlock_irqrestore, and then later attempts to access vm->task_info without reacquiring the necessary synchronization primitives.
This vulnerability directly maps to CWE-416, which addresses use after free conditions in memory management, though adapted to the specific context of lock-based resource management. The flaw represents a classic temporal race condition where the validity period of a reference extends beyond its intended scope due to improper synchronization handling. From an operational perspective, this issue creates potential for system crashes, data corruption, or privilege escalation attacks that could be exploited by malicious actors with kernel-level access or those capable of triggering specific concurrent execution patterns.
The mitigation strategy implemented involves removing the problematic amdgpu_vm_get_vm_from_pasid() function entirely from the amdgpu_vm.c source file and inlining the relevant code paths to ensure that all lock acquisition and release operations maintain proper temporal boundaries. This approach prevents the pointer reference from becoming invalid during critical sections of code execution while maintaining the necessary synchronization guarantees for concurrent access. The fix aligns with ATT&CK technique T1068 by addressing kernel-level privilege escalation vectors through improved memory management practices.
The solution demonstrates a fundamental principle in secure systems design where resource lifetimes must be carefully managed to prevent temporal race conditions. By ensuring that all code paths requiring access to locked resources maintain exclusive lock ownership throughout their execution, the vulnerability is fully resolved while preserving system functionality and performance characteristics. This approach represents a best practice for kernel-level synchronization that prevents similar issues from occurring in other subsystems where lock-based resource management is employed.
The fix also addresses broader security implications related to information disclosure and system stability that could arise from memory corruption due to invalid pointer dereferences. The cherry-picked commit ensures that the solution maintains backward compatibility while providing robust protection against concurrent access violations that could be exploited in privilege escalation scenarios or denial-of-service attacks targeting graphics processing unit subsystems. This remediation approach reflects industry standards for secure kernel development practices and demonstrates proper handling of shared resources in multi-threaded environments through appropriate lock management protocols.