{"id":"CVE-2026-74450","title":"drm/amd/pm: fix pptable use-after-free","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix pptable use-after-free\n\namdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table\nafter dropping adev->pm.mutex. The sysfs path then cop…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 3fbb3ac75000e3187f500a91a4099b24206866a1","Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 9efc767335234cf7a892e46d45cd453b711421e7","Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 81b5af1fb0f14cace6c3b3130a05e5602a597820","Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 8c685df5c3b261c42505110965b42f9a754eb9b7","Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < b628f2c6feb3a115ea72d3120a2bd94afc5163df","Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < bb493058c35c8676e48269ab6732688ea733d23c","Linux 4.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:56:51.440492Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:46.575Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74450","references":[{"url":"https://git.kernel.org/stable/c/3fbb3ac75000e3187f500a91a4099b24206866a1"},{"url":"https://git.kernel.org/stable/c/9efc767335234cf7a892e46d45cd453b711421e7"},{"url":"https://git.kernel.org/stable/c/81b5af1fb0f14cace6c3b3130a05e5602a597820"},{"url":"https://git.kernel.org/stable/c/8c685df5c3b261c42505110965b42f9a754eb9b7"},{"url":"https://git.kernel.org/stable/c/b628f2c6feb3a115ea72d3120a2bd94afc5163df"},{"url":"https://git.kernel.org/stable/c/bb493058c35c8676e48269ab6732688ea733d23c"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02034,"ingestedAt":"2026-10-16T19:46:24.361Z","slug":"CVE-2026-74450","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix pptable use-after-free\n\namdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table\nafter dropping adev->pm.mutex. The sysfs path then copies from that pointer.\nA concurrent pp_table write can replace and free the allocation during the\ncopy, causing a use-after-free.\n\nChange the DPM interface to copy into caller-provided storage while the mutex\nis held. Keep the size-only query for attribute discovery without exposing\nthe driver-owned pointer.\n\n(cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)\n\n## Affected\n\n- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 3fbb3ac75000e3187f500a91a4099b24206866a1`\n- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 9efc767335234cf7a892e46d45cd453b711421e7`\n- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 81b5af1fb0f14cace6c3b3130a05e5602a597820`\n- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 8c685df5c3b261c42505110965b42f9a754eb9b7`\n- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < b628f2c6feb3a115ea72d3120a2bd94afc5163df`\n- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < bb493058c35c8676e48269ab6732688ea733d23c`\n- `Linux 4.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}