High 7.8Published Aug 15, 2026

CVE-2026-74450drm/amd/pm: fix pptable use-after-free

Updated under an hour ago (Oct 27, 2026, 2:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free. Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer. (cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	1684d3ba488529266ce6f97b88076bd185f4790e builds before 3fbb3ac75000e3187f500a91a4099b24206866a1; 1684d3ba488529266ce6f97b88076bd185f4790e builds before 9efc767335234cf7a892e46d45cd453b711421e7; 1684d3ba488529266ce6f97b88076bd185f4790e builds before 81b5af1fb0f14cace6c3b3130a05e5602a597820; 1684d3ba488529266ce6f97b88076bd185f4790e builds before 8c685df5c3b261c42505110965b42f9a754eb9b7; from 1684d3ba488529266ce6f97b88076bd185f4790e before b628f2c6feb3a115ea72d3120a2bd94afc5163df; from 1684d3ba488529266ce6f97b88076bd185f4790e before bb493058c35c8676e48269ab6732688ea733d23c	CNA record

References

References

https://git.kernel.org/stable/c/3fbb3ac75000e3187f500a91a4099b24206866a1
https://git.kernel.org/stable/c/9efc767335234cf7a892e46d45cd453b711421e7
https://git.kernel.org/stable/c/81b5af1fb0f14cace6c3b3130a05e5602a597820
https://git.kernel.org/stable/c/8c685df5c3b261c42505110965b42f9a754eb9b7
https://git.kernel.org/stable/c/b628f2c6feb3a115ea72d3120a2bd94afc5163df
https://git.kernel.org/stable/c/bb493058c35c8676e48269ab6732688ea733d23c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.