Linux Kernel up to 7.1.7/7.2-rc5 DPM interface drm/amd/pm amdgpu_dpm_get_pp_table use after free

Summaryinfo

A vulnerability classified as very critical was found in Linux Kernel up to 7.1.7/7.2-rc5. This issue affects the function amdgpu_dpm_get_pp_table of the file drm/amd/pm of the component DPM interface. The manipulation results in use after free. This vulnerability was named CVE-2026-74450. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.7/7.2-rc5. It has been classified as very critical. Affected is the function amdgpu_dpm_get_pp_table of the file drm/amd/pm of the component DPM interface. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free. Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer. (cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-74450 since 08/15/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/15/2026).

Upgrading to version 7.1.8 or 7.2-rc6 eliminates this vulnerability. Applying the patch b628f2c6feb3a115ea72d3120a2bd94afc5163df/bb493058c35c8676e48269ab6732688ea733d23c is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3
• 7.2-rc4
• 7.2-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion