CVE-2026-68104

Received Received - Intake

AMDGPU Kernel Power Management Use-After-Free

Publication date: 2026-08-10

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Call pm_genpd_remove() to unregister from global list prior to releasing acp_genpd memory, and clear the pointer after free. (cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68104

EUVD

EUVD-2026-55485

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of power management domains in the AMDGPU driver. The issue occurs when the kernel fails to properly remove a power management domain before freeing its memory, potentially leading to system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMD GPU driver and does not have a direct network detection method. To check for affected systems, verify the kernel version and AMD GPU driver details using commands like 'uname -a' and 'modinfo amdgpu'.

Impact Analysis

This vulnerability may cause system crashes or instability, particularly on systems using AMD graphics. Users might experience unexpected reboots, freezes, or graphical glitches during normal operation.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel memory management issue in the AMD GPU driver. No evidence suggests data privacy or security impacts that would violate these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version. For systems using AMD GPUs, ensure the kernel includes the fix for the AMD GPU driver issue. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-68104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...