CVE-2026-74450 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/pm: fix pptable use-after-free
amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free.
Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer.
(cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the amdgpu driver within the Linux kernel and represents a classic use-after-free condition that can lead to system instability and potential privilege escalation. This flaw exists in the drm/amd/pm subsystem where the amdgpu_dpm_get_pp_table() function returns a pointer to a driver-owned power table structure after releasing the adev->pm.mutex lock. The design allows for concurrent access patterns that create dangerous race conditions during sysfs attribute operations. When a sysfs path attempts to copy data from this returned pointer, a concurrent process may modify or replace the power table structure while the copy operation is in progress, resulting in memory corruption when the freed memory is subsequently accessed.
The technical implementation of this vulnerability stems from improper synchronization mechanisms within the driver's power management interface. The amdgpu_dpm_get_pp_table() function violates proper locking protocols by releasing the mutex before returning a pointer to internal driver structures that remain accessible to other threads. This pattern creates a window of opportunity for race conditions where concurrent modifications can occur between the time the pointer is returned and when the calling code performs its copy operation. The specific context involves the power table (pptable) structure which contains critical performance parameters that control GPU behavior under various workload conditions, making this vulnerability particularly dangerous as it can affect system stability and potentially provide attack vectors for privilege escalation.
The operational impact of this use-after-free vulnerability extends beyond simple memory corruption to include potential system crashes, data loss, and in worst-case scenarios, exploitation for privilege escalation within the kernel space. When the freed power table structure is accessed after being deallocated, it can cause kernel oops messages, system panics, or more insidiously, allow malicious actors to craft payloads that exploit the memory layout to gain elevated privileges. The vulnerability affects systems running Linux kernels with amdgpu driver support, particularly those utilizing AMD GPU hardware where power management features are actively engaged, and can be triggered through normal system operations involving sysfs interface queries for power table information.
The fix implemented addresses this issue by modifying the DPM interface to copy data into caller-provided storage locations while maintaining the mutex lock during the entire operation. This approach eliminates the race condition by ensuring that no driver-owned pointers are exposed to external access after the lock is released, as required by the CWE-416 use-after-free vulnerability classification. The solution maintains backward compatibility through a size-only query mechanism that allows attribute discovery without exposing internal driver pointers, which aligns with secure coding principles and follows ATT&CK technique T1068 for privilege escalation prevention. By copying data while holding the mutex, the implementation prevents concurrent modification during access operations and ensures memory safety throughout the power table handling process, effectively mitigating both the immediate use-after-free condition and related security implications that could arise from improper synchronization in kernel driver interfaces.