CVE-2026-74450 (GCVE-0-2026-74450)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-23 12:47
VLAI
Title
drm/amd/pm: fix pptable use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free. Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer. (cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < 3fbb3ac75000e3187f500a91a4099b24206866a1 (git)
Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < 9efc767335234cf7a892e46d45cd453b711421e7 (git)
Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < 81b5af1fb0f14cace6c3b3130a05e5602a597820 (git)
Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < 8c685df5c3b261c42505110965b42f9a754eb9b7 (git)
Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < b628f2c6feb3a115ea72d3120a2bd94afc5163df (git)
Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < bb493058c35c8676e48269ab6732688ea733d23c (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/pm/amdgpu_dpm.c",
            "drivers/gpu/drm/amd/pm/amdgpu_pm.c",
            "drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3fbb3ac75000e3187f500a91a4099b24206866a1",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "9efc767335234cf7a892e46d45cd453b711421e7",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "81b5af1fb0f14cace6c3b3130a05e5602a597820",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "8c685df5c3b261c42505110965b42f9a754eb9b7",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "b628f2c6feb3a115ea72d3120a2bd94afc5163df",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "bb493058c35c8676e48269ab6732688ea733d23c",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/pm/amdgpu_dpm.c",
            "drivers/gpu/drm/amd/pm/amdgpu_pm.c",
            "drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix pptable use-after-free\n\namdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table\nafter dropping adev-\u003epm.mutex. The sysfs path then copies from that pointer.\nA concurrent pp_table write can replace and free the allocation during the\ncopy, causing a use-after-free.\n\nChange the DPM interface to copy into caller-provided storage while the mutex\nis held. Keep the size-only query for attribute discovery without exposing\nthe driver-owned pointer.\n\n(cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via local sysfs read/write on /sys/class/drm/cardN/device/pp_table (amdgpu_get_pp_table/amdgpu_set_pp_table); no network, adjacent, or physical-access path exists into amdgpu_dpm_get_pp_table().\nAC:L - A single attacker can drive both sides of the race with concurrent pp_table read and write threads; the write path holds pm.mutex during smu_reset/smu_sys_set_pp_table() while the read copies up to PAGE_SIZE-1 bytes from a pointer obtained after mutex drop.\nPR:L - Triggering the concurrent write/free requires sysfs write access to pp_table; the kernel CNA\u0027s CVE-2025-21780 scored the same attribute PR:L because gaming/handheld udev rules commonly group-write pp_* nodes and the commit describes a concurrent pp_table write.\nUI:N - Exploitation is performed by the attacker\u0027s own concurrent sysfs read/write loops; no action by another user or victim is required.\nS:U - The use-after-free corrupts kernel heap memory during a sysfs memcpy in amdgpu_pm.c; impact stays within the kernel security authority with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Use-after-free on a kmalloc\u0027d pp table during memcpy can return freed/reallocated kernel heap contents up to PAGE_SIZE-1 bytes to userspace and enables arbitrary kernel memory reads via heap grooming.\nI:H - Concurrent pp_table writes control kmalloc size/contents while reads dereference the freed pptable, classic UAF heap corruption that can be weaponized for arbitrary kernel writes and privilege escalation.\nA:H - Reading freed pptable memory during memcpy causes kernel oops/panic and smu_reset() during the concurrent write can wedge discrete AMD GPUs; UAF reliably threatens system/GPU availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:19.009Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3fbb3ac75000e3187f500a91a4099b24206866a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9efc767335234cf7a892e46d45cd453b711421e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/81b5af1fb0f14cace6c3b3130a05e5602a597820"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c685df5c3b261c42505110965b42f9a754eb9b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b628f2c6feb3a115ea72d3120a2bd94afc5163df"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb493058c35c8676e48269ab6732688ea733d23c"
        }
      ],
      "title": "drm/amd/pm: fix pptable use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74450",
    "datePublished": "2026-08-15T12:26:55.127Z",
    "dateReserved": "2026-08-15T05:44:03.899Z",
    "dateUpdated": "2026-08-23T12:47:19.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74450",
      "date": "2026-09-21",
      "epss": "0.00126",
      "percentile": "0.02592"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:48:55.000Z",
      "cve": "CVE-2026-74450",
      "id": "msrc_CVE-2026-74450",
      "initial_release_date": "2026-08-23T14:48:55.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amd/pm: fix pptable use-after-free",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74450.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/pm/amdgpu_dpm.c",
                  "drivers/gpu/drm/amd/pm/amdgpu_pm.c",
                  "drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3fbb3ac75000e3187f500a91a4099b24206866a1",
                    "status": "affected",
                    "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9efc767335234cf7a892e46d45cd453b711421e7",
                    "status": "affected",
                    "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "81b5af1fb0f14cace6c3b3130a05e5602a597820",
                    "status": "affected",
                    "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8c685df5c3b261c42505110965b42f9a754eb9b7",
                    "status": "affected",
                    "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b628f2c6feb3a115ea72d3120a2bd94afc5163df",
                    "status": "affected",
                    "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bb493058c35c8676e48269ab6732688ea733d23c",
                    "status": "affected",
                    "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/pm/amdgpu_dpm.c",
                  "drivers/gpu/drm/amd/pm/amdgpu_pm.c",
                  "drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.9"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.153",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix pptable use-after-free\n\namdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table\nafter dropping adev-\u003epm.mutex. The sysfs path then copies from that pointer.\nA concurrent pp_table write can replace and free the allocation during the\ncopy, causing a use-after-free.\n\nChange the DPM interface to copy into caller-provided storage while the mutex\nis held. Keep the size-only query for attribute discovery without exposing\nthe driver-owned pointer.\n\n(cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)"
          }
        ],
        "id": "CVE-2026-74450",
        "lastModified": "2026-08-23T13:16:43.837",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:49.593",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3fbb3ac75000e3187f500a91a4099b24206866a1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/81b5af1fb0f14cace6c3b3130a05e5602a597820"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8c685df5c3b261c42505110965b42f9a754eb9b7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9efc767335234cf7a892e46d45cd453b711421e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b628f2c6feb3a115ea72d3120a2bd94afc5163df"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bb493058c35c8676e48269ab6732688ea733d23c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:41:41+00:00",
      "cve": "CVE-2026-74450",
      "id": "CVE-2026-74450",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/pm: fix pptable use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74450.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:20:58Z",
      "cve": "CVE-2026-74450",
      "id": "CVE-2026-74450",
      "initial_release_date": "2026-08-15T23:52:49Z",
      "product_status:known_affected": "177",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74450",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74450.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.