CVE-2026-68104 (GCVE-0-2026-68104)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-19 16:29
VLAI
Title
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Call pm_genpd_remove() to unregister from global list prior to releasing acp_genpd memory, and clear the pointer after free. (cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 25030321ba2860c56651429a4f28d94a6483d952 , < 4d7c10b0bf09d90c81818752decbdb1966b62702 (git)
Affected: 25030321ba2860c56651429a4f28d94a6483d952 , < 493adf29d66f23888f0e29888b6bc9512acd0825 (git)
Affected: 25030321ba2860c56651429a4f28d94a6483d952 , < 2e406b86144c1f732eb344f1f1e09043856cfc33 (git)
Affected: 25030321ba2860c56651429a4f28d94a6483d952 , < bdfc7f1e0900ef1361b828c4f69b72701f8a0a86 (git)
Affected: 25030321ba2860c56651429a4f28d94a6483d952 , < 5c0a82283271759fff445ac27182072f200a888c (git)
Affected: 25030321ba2860c56651429a4f28d94a6483d952 , < 08fee493e0261f9e4120a5c8e7e42e8a723574e8 (git)
Affected: 25030321ba2860c56651429a4f28d94a6483d952 , < 930a5dc3df4aa5e10393134bd5313d616dbebaf6 (git)
Affected: 25030321ba2860c56651429a4f28d94a6483d952 , < 28c9b3c5dc35cc790d11e26ca3fc6e068be63998 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4d7c10b0bf09d90c81818752decbdb1966b62702",
              "status": "affected",
              "version": "25030321ba2860c56651429a4f28d94a6483d952",
              "versionType": "git"
            },
            {
              "lessThan": "493adf29d66f23888f0e29888b6bc9512acd0825",
              "status": "affected",
              "version": "25030321ba2860c56651429a4f28d94a6483d952",
              "versionType": "git"
            },
            {
              "lessThan": "2e406b86144c1f732eb344f1f1e09043856cfc33",
              "status": "affected",
              "version": "25030321ba2860c56651429a4f28d94a6483d952",
              "versionType": "git"
            },
            {
              "lessThan": "bdfc7f1e0900ef1361b828c4f69b72701f8a0a86",
              "status": "affected",
              "version": "25030321ba2860c56651429a4f28d94a6483d952",
              "versionType": "git"
            },
            {
              "lessThan": "5c0a82283271759fff445ac27182072f200a888c",
              "status": "affected",
              "version": "25030321ba2860c56651429a4f28d94a6483d952",
              "versionType": "git"
            },
            {
              "lessThan": "08fee493e0261f9e4120a5c8e7e42e8a723574e8",
              "status": "affected",
              "version": "25030321ba2860c56651429a4f28d94a6483d952",
              "versionType": "git"
            },
            {
              "lessThan": "930a5dc3df4aa5e10393134bd5313d616dbebaf6",
              "status": "affected",
              "version": "25030321ba2860c56651429a4f28d94a6483d952",
              "versionType": "git"
            },
            {
              "lessThan": "28c9b3c5dc35cc790d11e26ca3fc6e068be63998",
              "status": "affected",
              "version": "25030321ba2860c56651429a4f28d94a6483d952",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: invoke pm_genpd_remove() before freeing genpd\n\nCall pm_genpd_remove() to unregister from global list prior to releasing\nacp_genpd memory, and clear the pointer after free.\n\n(cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in acp_hw_fini during amdgpu driver teardown (amdgpu_pci_remove/amdgpu_driver_unload_kms), reachable via local PCI unbind/module unload or a failed amdgpu init cleanup after opening a DRM render node; there is no network-facing entry point.\nAC:L - Once the AMDGPU ACP block has been initialized, calling acp_hw_fini deterministically frees acp_genpd without unregistering it from the global genpd list; no race or special memory layout is required to leave a dangling list entry.\nPR:L - Unprivileged users with access to /dev/dri/renderD* can autoload amdgpu and trigger the fini path if initialization fails after ACP setup; the same bug also fires on privileged driver unload/hot-unplug teardown of AMDGPU on ACP-capable APUs (Carrizo/Stoney).\nUI:N - Exploitation does not require any victim interaction such as clicking links or mounting filesystems; triggering driver teardown or a failed init cleanup is sufficient once the attacker can open the DRM device or unload the driver.\nS:U - The use-after-free corrupts kernel heap metadata/objects in the same kernel security domain during AMDGPU/ACP teardown; it does not by itself cross VM, container, or IOMMU boundaries to impact a separate authority.\nC:H - Freeing the generic_pm_domain while it remains linked on the global gpd_list is a kernel use-after-free; subsequent genpd list walks can read attacker-influenced freed memory, enabling information disclosure and kernel pointer leaks.\nI:H - The dangling genpd entry allows the power-domain core to perform reads/writes through a freed acp_pm_domain/generic_pm_domain object, providing a standard heap UAF primitive that can be developed into arbitrary kernel memory corruption or code execution.\nA:H - Dereferencing the freed genpd from the global list during later power-management operations can cause kernel oops/panic or hang, and the UAF can be leveraged for a reliable denial-of-service even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:17.502Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4d7c10b0bf09d90c81818752decbdb1966b62702"
        },
        {
          "url": "https://git.kernel.org/stable/c/493adf29d66f23888f0e29888b6bc9512acd0825"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e406b86144c1f732eb344f1f1e09043856cfc33"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdfc7f1e0900ef1361b828c4f69b72701f8a0a86"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c0a82283271759fff445ac27182072f200a888c"
        },
        {
          "url": "https://git.kernel.org/stable/c/08fee493e0261f9e4120a5c8e7e42e8a723574e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/930a5dc3df4aa5e10393134bd5313d616dbebaf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/28c9b3c5dc35cc790d11e26ca3fc6e068be63998"
        }
      ],
      "title": "drm/amdgpu: invoke pm_genpd_remove() before freeing genpd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68104",
    "datePublished": "2026-08-10T11:58:20.614Z",
    "dateReserved": "2026-07-30T09:28:09.368Z",
    "dateUpdated": "2026-08-19T16:29:17.502Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68104",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.02928"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4d7c10b0bf09d90c81818752decbdb1966b62702",
                    "status": "affected",
                    "version": "25030321ba2860c56651429a4f28d94a6483d952",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "493adf29d66f23888f0e29888b6bc9512acd0825",
                    "status": "affected",
                    "version": "25030321ba2860c56651429a4f28d94a6483d952",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2e406b86144c1f732eb344f1f1e09043856cfc33",
                    "status": "affected",
                    "version": "25030321ba2860c56651429a4f28d94a6483d952",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bdfc7f1e0900ef1361b828c4f69b72701f8a0a86",
                    "status": "affected",
                    "version": "25030321ba2860c56651429a4f28d94a6483d952",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5c0a82283271759fff445ac27182072f200a888c",
                    "status": "affected",
                    "version": "25030321ba2860c56651429a4f28d94a6483d952",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08fee493e0261f9e4120a5c8e7e42e8a723574e8",
                    "status": "affected",
                    "version": "25030321ba2860c56651429a4f28d94a6483d952",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "930a5dc3df4aa5e10393134bd5313d616dbebaf6",
                    "status": "affected",
                    "version": "25030321ba2860c56651429a4f28d94a6483d952",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "28c9b3c5dc35cc790d11e26ca3fc6e068be63998",
                    "status": "affected",
                    "version": "25030321ba2860c56651429a4f28d94a6483d952",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.6"
                  },
                  {
                    "lessThan": "4.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: invoke pm_genpd_remove() before freeing genpd\n\nCall pm_genpd_remove() to unregister from global list prior to releasing\nacp_genpd memory, and clear the pointer after free.\n\n(cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2)"
          }
        ],
        "id": "CVE-2026-68104",
        "lastModified": "2026-08-19T17:20:28.520",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:19:55.097",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/08fee493e0261f9e4120a5c8e7e42e8a723574e8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/28c9b3c5dc35cc790d11e26ca3fc6e068be63998"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2e406b86144c1f732eb344f1f1e09043856cfc33"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/493adf29d66f23888f0e29888b6bc9512acd0825"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4d7c10b0bf09d90c81818752decbdb1966b62702"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5c0a82283271759fff445ac27182072f200a888c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/930a5dc3df4aa5e10393134bd5313d616dbebaf6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bdfc7f1e0900ef1361b828c4f69b72701f8a0a86"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:15:54+00:00",
      "cve": "CVE-2026-68104",
      "id": "CVE-2026-68104",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "275",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: invoke pm_genpd_remove() before freeing genpd",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68104.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-18T00:36:07Z",
      "cve": "CVE-2026-68104",
      "id": "CVE-2026-68104",
      "initial_release_date": "2026-08-13T01:28:26Z",
      "product_status:known_affected": "683",
      "product_status:known_not_affected": "65",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68104",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68104.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.