CVE-2026-74450
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free. Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer. (cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)
How to fix
- Linux Linux3fbb3ac75000e3187f500a91a4099b24206866a1, 9efc767335234cf7a892e46d45cd453b711421e7, 81b5af1fb0f14cace6c3b3130a05e5602a597820, 8c685df5c3b261c42505110965b42f9a754eb9b7, b628f2c6feb3a115ea72d3120a2bd94afc5163df, bb493058c35c8676e48269ab6732688ea733d23c or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 1684d3ba488529266ce6f97b88076bd185f4790e ≤ v < 3fbb3ac75000e3187f500a91a4099b24206866a1, 1684d3ba488529266ce6f97b88076bd185f4790e ≤ v < 9efc767335234cf7a892e46d45cd453b711421e7, 1684d3ba488529266ce6f97b88076bd185f4790e ≤ v < 81b5af1fb0f14cace6c3b3130a05e5602a597820, 1684d3ba488529266ce6f97b88076bd185f4790e ≤ v < 8c685df5c3b261c42505110965b42f9a754eb9b7, 1684d3ba488529266ce6f97b88076bd185f4790e ≤ v < b628f2c6feb3a115ea72d3120a2bd94afc5163df, 1684d3ba488529266ce6f97b88076bd185f4790e ≤ v < bb493058c35c8676e48269ab6732688ea733d23c, 4.9 | 3fbb3ac75000e3187f500a91a4099b24206866a1, 9efc767335234cf7a892e46d45cd453b711421e7, 81b5af1fb0f14cace6c3b3130a05e5602a597820, 8c685df5c3b261c42505110965b42f9a754eb9b7, b628f2c6feb3a115ea72d3120a2bd94afc5163df, bb493058c35c8676e48269ab6732688ea733d23c |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.