CVE-2026-74450
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, the amdgpu driver has a use-after-free vulnerability in amdgpu_dpm_get_pp_table(). The function returns a pointer to the power table after dropping the mutex, and a concurrent pp_table write can free the memory during the copy, leading to use-after-free. The fix copies data into caller-provided storage while holding the mutex.
Risk Assessment
A local attacker could cause kernel memory corruption, potentially leading to privilege escalation or system crash.
Recommendation
Apply the Linux kernel update containing the fix (commit f6eed7acfd30099ef7baeb6ba45bb59daad80631).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free. Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer. (cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)