CVE-2025-68793

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68793", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:30:51.037Z", "datePublished": "2026-01-13T15:29:04.877Z", "dateUpdated": "2026-10-19T18:05:07.405Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:11:29.613Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix a job->pasid access race in gpu recovery\n\nAvoid a possible UAF in GPU recovery due to a race between\nthe sched timeout callback and the tdr work queue.\n\nThe gpu recovery function calls drm_sched_stop() and\nlater drm_sched_start(). drm_sched_start() restarts\nthe tdr queue which will eventually free the job. If\nthe tdr queue frees the job before time out callback\ncompletes, the job will be freed and we'll get a UAF\nwhen accessing the pasid. Cache it early to avoid the\nUAF.\n\nExample KASAN trace:\n[ 493.058141] BUG: KASAN: slab-use-after-free in amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323\n[ 493.074892]\n[ 493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G E 6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary)\n[ 493.076493] Tainted: [E]=UNSIGNED_MODULE\n[ 493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019\n[ 493.076500] Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]\n[ 493.076512] Call Trace:\n[ 493.076515] <TASK>\n[ 493.076518] dump_stack_lvl+0x64/0x80\n[ 493.076529] print_report+0xce/0x630\n[ 493.076536] ? _raw_spin_lock_irqsave+0x86/0xd0\n[ 493.076541] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 493.076545] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077253] kasan_report+0xb8/0xf0\n[ 493.077258] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077965] amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.078672] ? __pfx_amdgpu_device_gpu_recover+0x10/0x10 [amdgpu]\n[ 493.079378] ? amdgpu_coredump+0x1fd/0x4c0 [amdgpu]\n[ 493.080111] amdgpu_job_timedout+0x642/0x1400 [amdgpu]\n[ 493.080903] ? pick_task_fair+0x24e/0x330\n[ 493.080910] ? __pfx_amdgpu_job_timedout+0x10/0x10 [amdgpu]\n[ 493.081702] ? _raw_spin_lock+0x75/0xc0\n[ 493.081708] ? __pfx__raw_spin_lock+0x10/0x10\n[ 493.081712] drm_sched_job_timedout+0x1b0/0x4b0 [gpu_sched]\n[ 493.081721] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081725] process_one_work+0x679/0xff0\n[ 493.081732] worker_thread+0x6ce/0xfd0\n[ 493.081736] ? __pfx_worker_thread+0x10/0x10\n[ 493.081739] kthread+0x376/0x730\n[ 493.081744] ? __pfx_kthread+0x10/0x10\n[ 493.081748] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081751] ? __pfx_kthread+0x10/0x10\n[ 493.081755] ret_from_fork+0x247/0x330\n[ 493.081761] ? __pfx_kthread+0x10/0x10\n[ 493.081764] ret_from_fork_asm+0x1a/0x30\n[ 493.081771] </TASK>\n\n(cherry picked from commit 20880a3fd5dd7bca1a079534cf6596bda92e107d)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through local AMDGPU command submission via a DRM render or primary device node; no network or physical protocol reaches this path.\nAC:L - The attacker controls job submission and can deliberately hang the GPU while maintaining concurrent submissions or heap spraying; the race is repeatable and requires no victim-controlled condition.\nPR:L - DRM_IOCTL_AMDGPU_CS is marked DRM_RENDER_ALLOW, and normal contexts require no capability; only ordinary unprivileged access to the AMDGPU render node is needed.\nUI:N - After the attacker submits the hanging job, the scheduler timeout, recovery, object freeing, and stale access occur automatically without another user's participation.\nS:U - The vulnerable DRM client and the affected host kernel remain under the same security authority; this is standard local kernel compromise rather than a VM or IOMMU boundary escape.\nC:H - This is a kernel slab use-after-free involving an attacker-created, variable-sized amdgpu_job allocation that can be reclaimed through heap spraying, making high-impact kernel memory disclosure defensible.\nI:H - Reclaiming the freed job with attacker-influenced allocations can support UAF exploitation and potential kernel memory manipulation or control-flow hijacking, resulting in complete integrity loss.\nA:H - The UAF was observed by KASAN in GPU recovery and can cause an oops or panic; repeated malicious hangs and recovery failures can also deny the GPU to all system users."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "versions": [{"version": "a72002cb181f350734108228b24c5d10d358f95a", "lessThan": "dac58c012c47cadf337a35eb05d44498c43e5cd0", "status": "affected", "versionType": "git"}, {"version": "a72002cb181f350734108228b24c5d10d358f95a", "lessThan": "77f73253015cbc7893fca1821ac3eae9eb4bc943", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.3", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dac58c012c47cadf337a35eb05d44498c43e5cd0"}, {"url": "https://git.kernel.org/stable/c/77f73253015cbc7893fca1821ac3eae9eb4bc943"}], "title": "drm/amdgpu: fix a job->pasid access race in gpu recovery", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68793", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:05:14.438714Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:05:07.405Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68793", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:05:14.438714Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:05:15.715Z"}}], "cna": {"title": "drm/amdgpu: fix a job->pasid access race in gpu recovery", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through local AMDGPU command submission via a DRM render or primary device node; no network or physical protocol reaches this path.\nAC:L - The attacker controls job submission and can deliberately hang the GPU while maintaining concurrent submissions or heap spraying; the race is repeatable and requires no victim-controlled condition.\nPR:L - DRM_IOCTL_AMDGPU_CS is marked DRM_RENDER_ALLOW, and normal contexts require no capability; only ordinary unprivileged access to the AMDGPU render node is needed.\nUI:N - After the attacker submits the hanging job, the scheduler timeout, recovery, object freeing, and stale access occur automatically without another user's participation.\nS:U - The vulnerable DRM client and the affected host kernel remain under the same security authority; this is standard local kernel compromise rather than a VM or IOMMU boundary escape.\nC:H - This is a kernel slab use-after-free involving an attacker-created, variable-sized amdgpu_job allocation that can be reclaimed through heap spraying, making high-impact kernel memory disclosure defensible.\nI:H - Reclaiming the freed job with attacker-influenced allocations can support UAF exploitation and potential kernel memory manipulation or control-flow hijacking, resulting in complete integrity loss.\nA:H - The UAF was observed by KASAN in GPU recovery and can cause an oops or panic; repeated malicious hangs and recovery failures can also deny the GPU to all system users."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a72002cb181f350734108228b24c5d10d358f95a", "lessThan": "dac58c012c47cadf337a35eb05d44498c43e5cd0", "versionType": "git"}, {"status": "affected", "version": "a72002cb181f350734108228b24c5d10d358f95a", "lessThan": "77f73253015cbc7893fca1821ac3eae9eb4bc943", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"status": "unaffected", "version": "0", "lessThan": "6.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.3", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/dac58c012c47cadf337a35eb05d44498c43e5cd0"}, {"url": "https://git.kernel.org/stable/c/77f73253015cbc7893fca1821ac3eae9eb4bc943"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix a job->pasid access race in gpu recovery\n\nAvoid a possible UAF in GPU recovery due to a race between\nthe sched timeout callback and the tdr work queue.\n\nThe gpu recovery function calls drm_sched_stop() and\nlater drm_sched_start(). drm_sched_start() restarts\nthe tdr queue which will eventually free the job. If\nthe tdr queue frees the job before time out callback\ncompletes, the job will be freed and we'll get a UAF\nwhen accessing the pasid. Cache it early to avoid the\nUAF.\n\nExample KASAN trace:\n[ 493.058141] BUG: KASAN: slab-use-after-free in amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323\n[ 493.074892]\n[ 493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G E 6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary)\n[ 493.076493] Tainted: [E]=UNSIGNED_MODULE\n[ 493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019\n[ 493.076500] Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]\n[ 493.076512] Call Trace:\n[ 493.076515] <TASK>\n[ 493.076518] dump_stack_lvl+0x64/0x80\n[ 493.076529] print_report+0xce/0x630\n[ 493.076536] ? _raw_spin_lock_irqsave+0x86/0xd0\n[ 493.076541] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 493.076545] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077253] kasan_report+0xb8/0xf0\n[ 493.077258] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077965] amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.078672] ? __pfx_amdgpu_device_gpu_recover+0x10/0x10 [amdgpu]\n[ 493.079378] ? amdgpu_coredump+0x1fd/0x4c0 [amdgpu]\n[ 493.080111] amdgpu_job_timedout+0x642/0x1400 [amdgpu]\n[ 493.080903] ? pick_task_fair+0x24e/0x330\n[ 493.080910] ? __pfx_amdgpu_job_timedout+0x10/0x10 [amdgpu]\n[ 493.081702] ? _raw_spin_lock+0x75/0xc0\n[ 493.081708] ? __pfx__raw_spin_lock+0x10/0x10\n[ 493.081712] drm_sched_job_timedout+0x1b0/0x4b0 [gpu_sched]\n[ 493.081721] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081725] process_one_work+0x679/0xff0\n[ 493.081732] worker_thread+0x6ce/0xfd0\n[ 493.081736] ? __pfx_worker_thread+0x10/0x10\n[ 493.081739] kthread+0x376/0x730\n[ 493.081744] ? __pfx_kthread+0x10/0x10\n[ 493.081748] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081751] ? __pfx_kthread+0x10/0x10\n[ 493.081755] ret_from_fork+0x247/0x330\n[ 493.081761] ? __pfx_kthread+0x10/0x10\n[ 493.081764] ret_from_fork_asm+0x1a/0x30\n[ 493.081771] </TASK>\n\n(cherry picked from commit 20880a3fd5dd7bca1a079534cf6596bda92e107d)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.3", "versionStartIncluding": "6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19", "versionStartIncluding": "6.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:11:29.613Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68793", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:05:07.405Z", "dateReserved": "2025-12-24T10:30:51.037Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-01-13T15:29:04.877Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dac58c012c47cadf337a35eb05d44498c43e5cd0", "status": "affected", "version": "a72002cb181f350734108228b24c5d10d358f95a", "versionType": "git"}, {"lessThan": "77f73253015cbc7893fca1821ac3eae9eb4bc943", "status": "affected", "version": "a72002cb181f350734108228b24c5d10d358f95a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix a job->pasid access race in gpu recovery\n\nAvoid a possible UAF in GPU recovery due to a race between\nthe sched timeout callback and the tdr work queue.\n\nThe gpu recovery function calls drm_sched_stop() and\nlater drm_sched_start(). drm_sched_start() restarts\nthe tdr queue which will eventually free the job. If\nthe tdr queue frees the job before time out callback\ncompletes, the job will be freed and we'll get a UAF\nwhen accessing the pasid. Cache it early to avoid the\nUAF.\n\nExample KASAN trace:\n[ 493.058141] BUG: KASAN: slab-use-after-free in amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323\n[ 493.074892]\n[ 493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G E 6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary)\n[ 493.076493] Tainted: [E]=UNSIGNED_MODULE\n[ 493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019\n[ 493.076500] Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]\n[ 493.076512] Call Trace:\n[ 493.076515] <TASK>\n[ 493.076518] dump_stack_lvl+0x64/0x80\n[ 493.076529] print_report+0xce/0x630\n[ 493.076536] ? _raw_spin_lock_irqsave+0x86/0xd0\n[ 493.076541] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 493.076545] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077253] kasan_report+0xb8/0xf0\n[ 493.077258] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077965] amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.078672] ? __pfx_amdgpu_device_gpu_recover+0x10/0x10 [amdgpu]\n[ 493.079378] ? amdgpu_coredump+0x1fd/0x4c0 [amdgpu]\n[ 493.080111] amdgpu_job_timedout+0x642/0x1400 [amdgpu]\n[ 493.080903] ? pick_task_fair+0x24e/0x330\n[ 493.080910] ? __pfx_amdgpu_job_timedout+0x10/0x10 [amdgpu]\n[ 493.081702] ? _raw_spin_lock+0x75/0xc0\n[ 493.081708] ? __pfx__raw_spin_lock+0x10/0x10\n[ 493.081712] drm_sched_job_timedout+0x1b0/0x4b0 [gpu_sched]\n[ 493.081721] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081725] process_one_work+0x679/0xff0\n[ 493.081732] worker_thread+0x6ce/0xfd0\n[ 493.081736] ? __pfx_worker_thread+0x10/0x10\n[ 493.081739] kthread+0x376/0x730\n[ 493.081744] ? __pfx_kthread+0x10/0x10\n[ 493.081748] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081751] ? __pfx_kthread+0x10/0x10\n[ 493.081755] ret_from_fork+0x247/0x330\n[ 493.081761] ? __pfx_kthread+0x10/0x10\n[ 493.081764] ret_from_fork_asm+0x1a/0x30\n[ 493.081771] </TASK>\n\n(cherry picked from commit 20880a3fd5dd7bca1a079534cf6596bda92e107d)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu: soluciona una condici\u00f3n de carrera de acceso a job-&gt;pasid en la recuperaci\u00f3n de la GPU\n\nEvita un posible UAF en la recuperaci\u00f3n de la GPU debido a una condici\u00f3n de carrera entre el callback de tiempo de espera de sched y la cola de trabajo tdr.\n\nLa funci\u00f3n de recuperaci\u00f3n de la GPU llama a drm_sched_stop() y luego a drm_sched_start(). drm_sched_start() reinicia la cola tdr que eventualmente liberar\u00e1 el trabajo (job). Si la cola tdr libera el trabajo (job) antes de que el callback de tiempo de espera se complete, el trabajo (job) ser\u00e1 liberado y obtendremos un UAF al acceder al pasid. Almacenarlo en cach\u00e9 con antelaci\u00f3n para evitar el UAF.\n\nEjemplo de traza KASAN:\n[ 493.058141] ERROR: KASAN: uso-despu\u00e9s-de-liberaci\u00f3n de slab en amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.067530] Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff88b0ce3f794c por la tarea kworker/u128:1/323\n[ 493.074892]\n[ 493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G E 6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntario)\n[ 493.076493] Tainted: [E]=UNSIGNED_MODULE\n[ 493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019\n[ 493.076500] Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]\n[ 493.076512] Traza de Llamada:\n[ 493.076515] \n[ 493.076518] dump_stack_lvl+0x64/0x80\n[ 493.076529] print_report+0xce/0x630\n[ 493.076536] ? _raw_spin_lock_irqsave+0x86/0xd0\n[ 493.076541] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 493.076545] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077253] kasan_report+0xb8/0xf0\n[ 493.077258] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077965] amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.078672] ? __pfx_amdgpu_device_gpu_recover+0x10/0x10 [amdgpu]\n[ 493.079378] ? amdgpu_coredump+0x1fd/0x4c0 [amdgpu]\n[ 493.080111] amdgpu_job_timedout+0x642/0x1400 [amdgpu]\n[ 493.080903] ? pick_task_fair+0x24e/0x330\n[ 493.080910] ? __pfx_amdgpu_job_timedout+0x10/0x10 [amdgpu]\n[ 493.081702] ? _raw_spin_lock+0x75/0xc0\n[ 493.081708] ? __pfx__raw_spin_lock+0x10/0x10\n[ 493.081712] drm_sched_job_timedout+0x1b0/0x4b0 [gpu_sched]\n[ 493.081721] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081725] process_one_work+0x679/0xff0\n[ 493.081732] worker_thread+0x6ce/0xfd0\n[ 493.081736] ? __pfx_worker_thread+0x10/0x10\n[ 493.081739] kthread+0x376/0x730\n[ 493.081744] ? __pfx_kthread+0x10/0x10\n[ 493.081748] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081751] ? __pfx_kthread+0x10/0x10\n[ 493.081755] ret_from_fork+0x247/0x330\n[ 493.081761] ? __pfx_kthread+0x10/0x10\n[ 493.081764] ret_from_fork_asm+0x1a/0x30\n[ 493.081771] \n\n(seleccionado de la confirmaci\u00f3n 20880a3fd5dd7bca1a079534cf6596bda92e107d)"}], "id": "CVE-2025-68793", "lastModified": "2026-10-19T19:17:05.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68793", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:05:14.438714Z", "version": "2.0.3"}}]}, "published": "2026-01-13T16:16:01.197", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/77f73253015cbc7893fca1821ac3eae9eb4bc943"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dac58c012c47cadf337a35eb05d44498c43e5cd0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: drm/amdgpu: fix a job->pasid access race in gpu recovery", "id": "2429081", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429081"}, "csaw": false, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: fix a job->pasid access race in gpu recovery\nAvoid a possible UAF in GPU recovery due to a race between\nthe sched timeout callback and the tdr work queue.\nThe gpu recovery function calls drm_sched_stop() and\nlater drm_sched_start(). drm_sched_start() restarts\nthe tdr queue which will eventually free the job. If\nthe tdr queue frees the job before time out callback\ncompletes, the job will be freed and we'll get a UAF\nwhen accessing the pasid. Cache it early to avoid the\nUAF.\nExample KASAN trace:\n[ 493.058141] BUG: KASAN: slab-use-after-free in amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323\n[ 493.074892]\n[ 493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G E 6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary)\n[ 493.076493] Tainted: [E]=UNSIGNED_MODULE\n[ 493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019\n[ 493.076500] Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]\n[ 493.076512] Call Trace:\n[ 493.076515] <TASK>\n[ 493.076518] dump_stack_lvl+0x64/0x80\n[ 493.076529] print_report+0xce/0x630\n[ 493.076536] ? _raw_spin_lock_irqsave+0x86/0xd0\n[ 493.076541] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 493.076545] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077253] kasan_report+0xb8/0xf0\n[ 493.077258] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.077965] amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]\n[ 493.078672] ? __pfx_amdgpu_device_gpu_recover+0x10/0x10 [amdgpu]\n[ 493.079378] ? amdgpu_coredump+0x1fd/0x4c0 [amdgpu]\n[ 493.080111] amdgpu_job_timedout+0x642/0x1400 [amdgpu]\n[ 493.080903] ? pick_task_fair+0x24e/0x330\n[ 493.080910] ? __pfx_amdgpu_job_timedout+0x10/0x10 [amdgpu]\n[ 493.081702] ? _raw_spin_lock+0x75/0xc0\n[ 493.081708] ? __pfx__raw_spin_lock+0x10/0x10\n[ 493.081712] drm_sched_job_timedout+0x1b0/0x4b0 [gpu_sched]\n[ 493.081721] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081725] process_one_work+0x679/0xff0\n[ 493.081732] worker_thread+0x6ce/0xfd0\n[ 493.081736] ? __pfx_worker_thread+0x10/0x10\n[ 493.081739] kthread+0x376/0x730\n[ 493.081744] ? __pfx_kthread+0x10/0x10\n[ 493.081748] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 493.081751] ? __pfx_kthread+0x10/0x10\n[ 493.081755] ret_from_fork+0x247/0x330\n[ 493.081761] ? __pfx_kthread+0x10/0x10\n[ 493.081764] ret_from_fork_asm+0x1a/0x30\n[ 493.081771] </TASK>\n(cherry picked from commit 20880a3fd5dd7bca1a079534cf6596bda92e107d)"], "name": "CVE-2025-68793", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68793\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68793\nhttps://lore.kernel.org/linux-cve-announce/2026011305-CVE-2025-68793-bb5f@gregkh/T"]}

{}