CVE-2026-74450

Received Received - Intake

Use-After-Free in AMDGPU Power Management

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free. Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer. (cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74450

EUVD

EUVD-2026-59643

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's AMD GPU driver. It occurs when a function returns a pointer to a power table that can be freed by another process while the original process is still using it. Specifically, amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after releasing a mutex. A concurrent write operation can replace and free this table during its use, leading to memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMD GPU driver (amdgpu) and involves a use-after-free in power table handling. Detection requires checking kernel logs for related errors or kernel crashes. Commands like dmesg | grep -i amdgpu or journalctl -k | grep -i amdgpu may reveal issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker with local access to cause system instability, crashes, or potentially execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or unauthorized access to sensitive data on affected systems running vulnerable Linux kernels with AMD GPUs.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's AMD GPU power management code. It does not directly relate to data protection or privacy standards like GDPR or HIPAA, as it involves memory corruption in a graphics driver rather than data handling or access control.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a version that includes the fix for this vulnerability. Check your distribution's security updates or kernel patches. If updating is not immediately possible, consider disabling the AMD GPU driver or restricting access to sysfs paths related to power tables as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-74450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70