CVE-2026-68245

drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

State: Published
Severity: 7.8 High
Published: Aug 10, 2026
Updated: Oct 30, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_irqrestore is called and returned, the pointer is no longer under lock and is subject to modification. Since, the caller still dereferences vm->task_info in amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a use after unlock problem.

Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() through removing the amdgpu_vm_get_vm_from_pasid() function from amdgpu_vm.c and making the relevant code inline to hold the lock while it is still in use.

(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	b8f67b9ddf4f8fe6dd536590712b5912ad78f99c to before fe16a7e5336ae888751984e30c451fbf7cfa5df7Affected b8f67b9ddf4f8fe6dd536590712b5912ad78f99c to before 1173190412fb9d12e7efce76734118d9712ff970Affected b8f67b9ddf4f8fe6dd536590712b5912ad78f99c to before 5d5fb9124a2bba96a7807086d8fe0f7ce810d546Affected b8f67b9ddf4f8fe6dd536590712b5912ad78f99c to before 04cc4aa3617b0ed67e859f91f09de5d896a46f3aAffected aa22d6c58505d239814b5ef8fa7da4ce43e9212bAffected 251840f22eff35c25de531a3fcb523df94c128c0Affected 6.1.191 to before 6.2Affected 6.6.160 to before 6.7Affected
LinuxLinux	6.9Affected before 6.9Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

b8f67b9ddf4f8fe6dd536590712b5912ad78f99c to before fe16a7e5336ae888751984e30c451fbf7cfa5df7Affected
b8f67b9ddf4f8fe6dd536590712b5912ad78f99c to before 1173190412fb9d12e7efce76734118d9712ff970Affected
b8f67b9ddf4f8fe6dd536590712b5912ad78f99c to before 5d5fb9124a2bba96a7807086d8fe0f7ce810d546Affected
b8f67b9ddf4f8fe6dd536590712b5912ad78f99c to before 04cc4aa3617b0ed67e859f91f09de5d896a46f3aAffected
aa22d6c58505d239814b5ef8fa7da4ce43e9212bAffected
251840f22eff35c25de531a3fcb523df94c128c0Affected
6.1.191 to before 6.2Affected
6.6.160 to before 6.7Affected

LinuxLinux

6.9Affected
before 6.9Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.