Read the docs
TI-2026-48052 Aliases CVE-2026-68273GHSA-vqhc-jp86-9g52

drm/amdgpu: Fix context pstate override handling

Priority LOW 35CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 14 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Both are due amdgpu_ctx_init() not holding the adev->pm.stable_pstate_ctx_lock, which is otherwise used from both sysfs and the context code itself for modifying and clearing the stored context pointer. Second issue is that context fini can trample over the pstate configuration set via sysfs. This is due the restore state (ctx->stable_pstate) being saved at context init time, and not if, or when the context actually changes the pstate. As the context exits it will therefore incorrectly restore to what was set before the sysfs override was requested. The simplest fix is to drastically simplify how the state is tracked, by clearly defining the points at which pstate ownership is taken and released, and to handle all transitions under the correct lock. Instead of at context init time, the previous state is saved only at the point the context overrides the current state, and is restored on context exit only if the context is still the owner of the current override state. (cherry picked from commit 1b5e413713c0a93bc1818394d0ce49aaad21bd27)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00132 2nd percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.1, 6.1.191, 6.6.160 +4Red Hat: 4 advisoriesRed Hat: 14 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.0.7 to before 6.16.1Patch availableCNA
LinuxLinux6.1 and later6.1.191, 6.6.160, 6.12.103, 6.18.44, 7.1.6, 7.2Patch availableCNA
  • Linux VendorLinux Affected 6.0.7 to before 6.1 Fixed in 6.1 Patch available CNA
  • Linux VendorLinux Affected 6.1 and later Fixed in 6.1.191, 6.6.160, 6.12.103, 6.18.44, 7.1.6, 7.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 6.1
  • Fix · CNA Linux (Linux) Fixed in 6.1.191, 6.6.160, 6.12.103, 6.18.44, 7.1.6, 7.2

Red Hat 4 advisories

  • RHSA-2026:72468 Released 2026-09-28 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.169.1.el8_10, kernel-4.18.0-553.169.1.el8_10, kernel-abi-stablelists-4.18.0-553.169.1.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.169.1.el8_10
  • RHSA-2026:72467 Released 2026-09-28 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.169.1.rt7.510.el8_10, kernel-rt-core-4.18.0-553.169.1.rt7.510.el8_10, kernel-rt-debug-4.18.0-553.169.1.rt7.510.el8_10 +9
    • Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.169.1.rt7.510.el8_10, kernel-rt-core-4.18.0-553.169.1.rt7.510.el8_10, kernel-rt-debug-4.18.0-553.169.1.rt7.510.el8_10 +7
  • RHSA-2026:71700 Released 2026-09-25 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-687.52.1.el9_8, kernel-64k-debug-devel-matched-5.14.0-687.52.1.el9_8, kernel-64k-devel-5.14.0-687.52.1.el9_8 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-687.52.1.el9_8, kernel-64k-5.14.0-687.52.1.el9_8, kernel-64k-core-5.14.0-687.52.1.el9_8 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-687.52.1.el9_8, libperf-5.14.0-687.52.1.el9_8
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-687.52.1.el9_8, kernel-rt-64k-5.14.0-687.52.1.el9_8, kernel-rt-64k-core-5.14.0-687.52.1.el9_8 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-687.52.1.el9_8, kernel-rt-core-5.14.0-687.52.1.el9_8, kernel-rt-debug-5.14.0-687.52.1.el9_8 +9
Show 1 more Red Hat advisories
  • RHSA-2026:71602 Released 2026-09-24 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.60.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.60.1.el10_2, kernel-64k-devel-6.12.0-211.60.1.el10_2 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.60.1.el10_2, kernel-64k-6.12.0-211.60.1.el10_2, kernel-64k-core-6.12.0-211.60.1.el10_2 +29
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.60.1.el10_2, libperf-6.12.0-211.60.1.el10_2
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.60.1.el10_2, kernel-rt-64k-6.12.0-211.60.1.el10_2, kernel-rt-64k-core-6.12.0-211.60.1.el10_2 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.60.1.el10_2, kernel-rt-core-6.12.0-211.60.1.el10_2, kernel-rt-debug-6.12.0-211.60.1.el10_2 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux for NVIDIA 26AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:71602
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:71700
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:71602
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:72468
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:71700
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:72468
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:71602
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:71700
Red Hat Enterprise Linux NFV (v. 8)Fixed RHSA-2026:72467
Red Hat Enterprise Linux RT (v. 8)Fixed RHSA-2026:72467
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2026:71602
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2026:71700
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2026:71602
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2026:71700
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68273
  2. 2026-10-03 Alias added: GHSA-vqhc-jp86-9g52
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-20 Weakness changed · CISA ADP
  5. 2026-10-21 Fix available: Linux/Linux@3531910845165dcf1a213267199ccc97e03cd58a, Linux/[email protected] · CNA
  6. 2026-10-21 1 new reference · CNA
  7. 2026-10-29 Affected versions changed · Red Hat
  8. 2026-10-30 Affected versions changed · Red Hat
  9. 2026-10-30 CVSS score changed · Red Hat
  10. 2026-10-30 Fix available: Linux/[email protected], Linux/Linux@ebed6179c993f07da24d0a454816e7da790377af · CNA
  11. 2026-10-30 1 new reference · CNA

References

Other 6

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21741 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences