# CVE-2026-68273: drm/amdgpu: Fix context pstate override handling

> A race condition in the AMD GPU driver allows use-after-free and null dereferences, potentially leading to system crashes or privilege escalation.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Aug 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-94875, BELL-CVE-2026-68273, DEBIAN-CVE-2026-68273, GHSA-vqhc-jp86-9g52, UBUNTU-CVE-2026-68273

## What is CVE-2026-68273?

CVE-2026-68273 is a high-severity vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix context pstate override handling

There are several problems in the context pstate handling code.

The most serious ones are potential use-after-free and NULL pointer
dereferences at context initialization time. Both are due
amdgpu_ctx_init() not holding the adev->pm.stable_pstate_ctx_lock, which
is otherwise used from both sysfs and the context code itself for
modifying and clearing the stored context pointer.

Second issue is that context fini can trample over the pstate
configuration set via sysfs. This is due the restore state
(ctx->stable_pstate) being saved at context init time, and not if, or when
the context actually changes the pstate. As the context exits it will
therefore incorrectly restore to what was set before the sysfs override
was requested.

The simplest fix is to drastically simplify how the state is tracked, by
clearly defining the points at which pstate ownership is taken and
released, and to handle all transitions under the correct lock.

Instead of at context init time, the previous state is saved only at the
point the context overrides the current state, and is restored on context
exit only if the context is still the owner of the current override state.

(cherry picked from commit 1b5e413713c0a93bc1818394d0ce49aaad21bd27)

Weakness: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)

## Which versions are affected by CVE-2026-68273?


## How do I fix CVE-2026-68273?

Apply the vendor's patch.

## Is CVE-2026-68273 being exploited?

There is no known exploitation of CVE-2026-68273 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-68273 and fix it if it is affected.

What it is: CVE-2026-68273 is a high-severity vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-68273 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-68273/ (Markdown: https://insights.sbomify.com/CVE-2026-68273/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-68273
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68273
- OSV: https://osv.dev/vulnerability/CVE-2026-68273

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-68273/
Summaries are generated and may contain mistakes; the official description above is the record.