Executive brief
The Linux kernel's AMD GPU driver fails to properly unregister from a global power management list before freeing memory, potentially leading to use-after-free errors. This can cause system instability, crashes, or provide a vector for kernel privilege escalation on systems with AMD GPUs.
Technical details
A use-after-free vulnerability exists in the AMD GPU (amdgpu) driver's power domain cleanup code. The vulnerable component fails to call pm_genpd_remove() to unregister the generic power domain (genpd) structure from the global list before freeing the underlying memory via kfree(). An attacker with local access or a malicious kernel module could potentially trigger the cleanup path to cause a use-after-free condition, leading to kernel memory corruption, denial of service, or privilege escalation. The fix requires invoking pm_genpd_remove() prior to kfree() and clearing the pointer afterward. Patches are available in upstream Linux kernel commits 28c9b3c5dc35cc790d11e26ca3fc6e068be63998 and 08fee493e0261f9e4120a5c8e7e42e8a723574e8.
Affected products
- Linux Linux kernel Multiple versions (patch applied upstream)
Timeline
- 2026-08-10: disclosed: CVE-2026-68104 published
- 2026-06-22: patched: Fix committed upstream (commit 28c9b3c5dc35cc790d11e26ca3fc6e068be63998)
- 2026-08-03: patched: Stable backport (commit 08fee493e0261f9e4120a5c8e7e42e8a723574e8)