CVE-2026-68273

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached only through the DRM_IOCTL_AMDGPU_CTX ioctl on a local /dev/dri/renderD* or card* node (registered DRM_AUTH|DRM_RENDER_ALLOW in amdgpu_drv.c:3063), and the racing writer is the local sysfs power_dpm_force_performance_level path. No network or adjacent-network path reaches amdgpu context pstate handling.

AC:LAttack complexity, low

The attacker owns both sides of the race — one thread loops AMDGPU_CTX_OP_SET_STABLE_PSTATE and context free while another loops AMDGPU_CTX_OP_ALLOC_CTX — and can retry indefinitely. The dangling-pointer variant (fini re-assigning adev->pm.stable_pstate_ctx = ctx just before kfree) needs no race at all: once latched, every later context creation dereferences freed memory deterministically.

PR:LPrivileges required, low

No capability or authorization check exists anywhere on the path (amdgpu_ctx_ioctl -> amdgpu_ctx_alloc/amdgpu_ctx_stable_pstate -> amdgpu_ctx_init); an unprivileged local user only needs an open render node fd, which is routinely granted to desktop users in the render/video group, to containers, sandboxed GPU processes, and to ordinary apps on Android/Chrome OS.

UI:NUser interaction, none

The attacker triggers everything with its own ioctls on its own file descriptors and its own threads; no action by another user or administrator is required, and the crash or freed-object read happens synchronously in the attacker's own syscall.

S:UScope, unchanged

The corrupted state (adev->pm.stable_pstate_ctx and the freed struct amdgpu_ctx) and all consequences stay within the kernel of the machine running the amdgpu driver; no VM, IOMMU, or sandbox security boundary is crossed.

C:HConfidentiality impact, high

amdgpu_ctx_init() dereferences a stale adev->pm.stable_pstate_ctx pointer after the context has been kfree()d, reading a field out of a freed kmalloc object that the attacker can reclaim and control via heap spraying; per kernel scoring guidance a use-after-free is treated as High since freed-object access can be leveraged toward kernel memory disclosure.

I:HIntegrity impact, high

The unlocked read/write of the global pstate-owner pointer leaves a dangling kernel pointer in adev->pm.stable_pstate_ctx and lets a freed, attacker-reclaimable object drive amdgpu_dpm_force_performance_level(); the commit also documents context teardown trampling the DPM configuration set through root-only sysfs, so an unprivileged user corrupts privileged device state.

A:HAvailability impact, high

The unlocked check-then-use of adev->pm.stable_pstate_ctx yields a NULL pointer dereference when a concurrent fini or sysfs write clears it, and the stale-pointer case faults on freed or unmapped slab memory — either produces a kernel oops and a wedged GPU, repeatable at will by an unprivileged local user.