Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-74450

drm/amd/pm: fix pptable use-after-free

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free. Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer. (cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1684d3ba488529266ce6f97b88076bd185f4790e to < 3fbb3ac75000e3187f500a91a4099b24206866a1affected
  • 1684d3ba488529266ce6f97b88076bd185f4790e to < 9efc767335234cf7a892e46d45cd453b711421e7affected
  • 1684d3ba488529266ce6f97b88076bd185f4790e to < 81b5af1fb0f14cace6c3b3130a05e5602a597820affected
  • 1684d3ba488529266ce6f97b88076bd185f4790e to < 8c685df5c3b261c42505110965b42f9a754eb9b7affected
  • 1684d3ba488529266ce6f97b88076bd185f4790e to < b628f2c6feb3a115ea72d3120a2bd94afc5163dfaffected
  • 1684d3ba488529266ce6f97b88076bd185f4790e to < bb493058c35c8676e48269ab6732688ea733d23caffected

Linux Linux

Default version status: affected

  • 4.9affected
  • 0 to < 4.9unaffected
  • 6.1.184 to ≤ 6.1.*unaffected
  • 6.6.153 to ≤ 6.6.*unaffected
  • 6.12.105 to ≤ 6.12.*unaffected
  • 6.18.46 to ≤ 6.18.*unaffected
  • 7.1.8 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References