CVE-2026-68273

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: Fix context pstate override handling<br /> <br /> There are several problems in the context pstate handling code.<br /> <br /> The most serious ones are potential use-after-free and NULL pointer<br /> dereferences at context initialization time. Both are due<br /> amdgpu_ctx_init() not holding the adev-&gt;pm.stable_pstate_ctx_lock, which<br /> is otherwise used from both sysfs and the context code itself for<br /> modifying and clearing the stored context pointer.<br /> <br /> Second issue is that context fini can trample over the pstate<br /> configuration set via sysfs. This is due the restore state<br /> (ctx-&gt;stable_pstate) being saved at context init time, and not if, or when<br /> the context actually changes the pstate. As the context exits it will<br /> therefore incorrectly restore to what was set before the sysfs override<br /> was requested.<br /> <br /> The simplest fix is to drastically simplify how the state is tracked, by<br /> clearly defining the points at which pstate ownership is taken and<br /> released, and to handle all transitions under the correct lock.<br /> <br /> Instead of at context init time, the previous state is saved only at the<br /> point the context overrides the current state, and is restored on context<br /> exit only if the context is still the owner of the current override state.<br /> <br /> (cherry picked from commit 1b5e413713c0a93bc1818394d0ce49aaad21bd27)