---
id: CVE-2026-74450
title: 'drm/amd/pm: fix pptable use-after-free'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amd/pm: fix pptable use-after-free

  amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table
  after dropping adev->pm.mutex. The sysfs path then cop…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e <
    3fbb3ac75000e3187f500a91a4099b24206866a1
  - >-
    Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e <
    9efc767335234cf7a892e46d45cd453b711421e7
  - >-
    Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e <
    81b5af1fb0f14cace6c3b3130a05e5602a597820
  - >-
    Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e <
    8c685df5c3b261c42505110965b42f9a754eb9b7
  - >-
    Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e <
    b628f2c6feb3a115ea72d3120a2bd94afc5163df
  - >-
    Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e <
    bb493058c35c8676e48269ab6732688ea733d23c
  - Linux 4.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:51.440492Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:46.575Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74450'
references:
  - url: 'https://git.kernel.org/stable/c/3fbb3ac75000e3187f500a91a4099b24206866a1'
  - url: 'https://git.kernel.org/stable/c/9efc767335234cf7a892e46d45cd453b711421e7'
  - url: 'https://git.kernel.org/stable/c/81b5af1fb0f14cace6c3b3130a05e5602a597820'
  - url: 'https://git.kernel.org/stable/c/8c685df5c3b261c42505110965b42f9a754eb9b7'
  - url: 'https://git.kernel.org/stable/c/b628f2c6feb3a115ea72d3120a2bd94afc5163df'
  - url: 'https://git.kernel.org/stable/c/bb493058c35c8676e48269ab6732688ea733d23c'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02034
ingestedAt: '2026-10-16T19:46:24.361Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix pptable use-after-free

amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table
after dropping adev->pm.mutex. The sysfs path then copies from that pointer.
A concurrent pp_table write can replace and free the allocation during the
copy, causing a use-after-free.

Change the DPM interface to copy into caller-provided storage while the mutex
is held. Keep the size-only query for attribute discovery without exposing
the driver-owned pointer.

(cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)

## Affected

- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 3fbb3ac75000e3187f500a91a4099b24206866a1`
- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 9efc767335234cf7a892e46d45cd453b711421e7`
- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 81b5af1fb0f14cace6c3b3130a05e5602a597820`
- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < 8c685df5c3b261c42505110965b42f9a754eb9b7`
- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < b628f2c6feb3a115ea72d3120a2bd94afc5163df`
- `Linux >= 1684d3ba488529266ce6f97b88076bd185f4790e < bb493058c35c8676e48269ab6732688ea733d23c`
- `Linux 4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.