CVE-2026-68245: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-10-30
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_irqrestore is called and returned, the pointer is no longer under lock and is subject to modification. Since, the caller still dereferences vm->task_info in amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a use after unlock problem. Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() through removing the amdgpu_vm_get_vm_from_pasid() function from amdgpu_vm.c and making the relevant code inline to hold the lock while it is still in use. (cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)

Affected products

Linux: from 6.1.191 before 6.2; from 6.6.160 before 6.7 — fixed in 6.2, 6.7

How to fix

Upgrade to a fixed version: Linux 6.2, 6.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-68245 or the next vulnerability affects your stack