CVE-2025-68793: drm/amdgpu: fix a job->pasid access race in gpu recovery
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix a job->pasid access race in gpu recovery
Avoid a possible UAF in GPU recovery due to a race between the sched timeout callback and the tdr work queue.
The gpu recovery function calls drmschedstop() and later drmschedstart(). drmschedstart() restarts the tdr queue which will eventually free the job. If the tdr queue frees the job before time out callback completes, the job will be freed and we'll get a UAF when accessing the pasid. Cache it early to avoid the UAF.
Example KASAN trace: [ 493.058141] BUG: KASAN: slab-use-after-free in amdgpudevicegpurecover+0x968/0x990 [amdgpu] [ 493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323 [ 493.074892] [ 493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G E 6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary) [ 493.076493] Tainted: [E]=UNSIGNEDMODULE [ 493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019 [ 493.076500] Workqueue: amdgpu-reset-dev drmschedjobtimedout [gpusched] [ 493.076512] Call Trace: [ 493.076515] <TASK> [ 493.076518] dumpstacklvl+0x64/0x80 [ 493.076529] printreport+0xce/0x630 [ 493.076536] ? rawspinlockirqsave+0x86/0xd0 [ 493.076541] ? pfxrawspinlockirqsave+0x10/0x10 [ 493.076545] ? amdgpudevicegpurecover+0x968/0x990 [amdgpu] [ 493.077253] kasanreport+0xb8/0xf0 [ 493.077258] ? amdgpudevicegpurecover+0x968/0x990 [amdgpu] [ 493.077965] amdgpudevicegpurecover+0x968/0x990 [amdgpu] [ 493.078672] ? pfxamdgpudevicegpurecover+0x10/0x10 [amdgpu] [ 493.079378] ? amdgpucoredump+0x1fd/0x4c0 [amdgpu] [ 493.080111] amdgpujobtimedout+0x642/0x1400 [amdgpu] [ 493.080903] ? picktaskfair+0x24e/0x330 [ 493.080910] ? pfxamdgpujobtimedout+0x10/0x10 [amdgpu] [ 493.081702] ? rawspinlock+0x75/0xc0 [ 493.081708] ? pfxrawspinlock+0x10/0x10 [ 493.081712] drmschedjobtimedout+0x1b0/0x4b0 [gpusched] [ 493.081721] ? pfxrawspinlockirq+0x10/0x10 [ 493.081725] processonework+0x679/0xff0 [ 493.081732] workerthread+0x6ce/0xfd0 [ 493.081736] ? pfxworkerthread+0x10/0x10 [ 493.081739] kthread+0x376/0x730 [ 493.081744] ? pfxkthread+0x10/0x10 [ 493.081748] ? pfxrawspinlockirq+0x10/0x10 [ 493.081751] ? pfxkthread+0x10/0x10 [ 493.081755] retfromfork+0x247/0x330 [ 493.081761] ? pfxkthread+0x10/0x10 [ 493.081764] retfromforkasm+0x1a/0x30 [ 493.081771] </TASK>
(cherry picked from commit 20880a3fd5dd7bca1a079534cf6596bda92e107d)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68793?
CVE-2025-68793 is classified as a medium severity vulnerability due to its potential impact on GPU recovery in the Linux kernel.
How do I fix CVE-2025-68793?
To fix CVE-2025-68793, upgrade to the latest version of the Linux kernel where the vulnerability has been addressed.
What software is affected by CVE-2025-68793?
CVE-2025-68793 affects the Linux kernel, particularly systems utilizing the amdgpu driver.
What is the nature of CVE-2025-68793?
CVE-2025-68793 involves a race condition that could lead to a use-after-free situation during GPU recovery.
What impact does CVE-2025-68793 have on system stability?
The impact of CVE-2025-68793 can result in crashes or instability during GPU recovery operations in affected systems.