Bug 2513430 (CVE-2026-68245)

Summary: CVE-2026-68245 kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the `drm/amdgpu` component of the Linux kernel. A use-after-unlock vulnerability exists where a virtual machine (VM) pointer is dereferenced after its protective lock has been released. This allows the pointer to be modified, potentially leading to memory corruption. An attacker could exploit this to cause a denial of service or achieve privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-10 12:36:53 UTC 
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only
valid while the lock is still being held. Once xa_unlock_irqrestore is
called and returned, the pointer is no longer under lock and is subject
to modification. Since, the caller still dereferences vm->task_info in
amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a
use after unlock problem.

Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid()
through removing the amdgpu_vm_get_vm_from_pasid() function from
amdgpu_vm.c and making the relevant code inline to hold the lock while
it is still in use.

(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)
Comment 1 Mauro Matteo Cascella 2026-08-11 09:39:38 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081019-CVE-2026-68245-15a4@gregkh/T