CVE-2026-68104: Linux Kernel Privilege Escalation Flaw

CVE-2026-68104 Overview

CVE-2026-68104 is a use-after-free vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu). The flaw resides in the Audio Coprocessor (ACP) generic power domain (genpd) cleanup path. The driver frees the acp_genpd memory without first calling pm_genpd_remove() to unregister it from the global power domain list. A stale pointer to the freed genpd remains reachable through the global list, enabling later access to freed memory.

The issue was resolved by invoking pm_genpd_remove() before releasing acp_genpd and clearing the pointer after free.

Critical Impact
A local authenticated attacker on a system with an affected AMD GPU driver can trigger the use-after-free to achieve kernel memory corruption, leading to privilege escalation or denial of service.

Affected Products

Linux kernel builds containing the drm/amdgpu ACP genpd cleanup code prior to the fix
Distributions shipping vulnerable stable kernels referenced in the upstream commits
Systems using AMD GPUs with the Audio Coprocessor (ACP) power domain enabled

Discovery Timeline

2026-08-10 - CVE-2026-68104 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68104

Vulnerability Analysis

The vulnerability is a use-after-free condition in the AMD GPU Direct Rendering Manager (DRM) driver. The amdgpu driver registers an ACP generic power domain (acp_genpd) with the kernel's power management framework using pm_genpd_init(). During teardown, the driver released the memory backing acp_genpd without first calling pm_genpd_remove().

The kernel maintains a global list (gpd_list) of all registered generic power domains. When the driver freed acp_genpd without deregistration, the global list retained a dangling pointer to freed memory. Any subsequent traversal of gpd_list, whether from another driver, sysfs access, or power management framework operations, would dereference freed kernel memory.

Root Cause

The root cause is missing cleanup ordering in the AMD GPU driver's ACP subsystem. The teardown path skipped the unregistration call that removes the genpd from the framework-managed list. Because acp_genpd was embedded in driver-allocated memory, freeing that allocation invalidated an entry still referenced by kernel-wide state.

The fix, referenced in upstream commit cd8650d7a91ee8b768e202354672553faa5cc1f2, adds a pm_genpd_remove() call before the free and nulls the pointer after release to prevent double-free and further use-after-free access.

Attack Vector

Exploitation requires local access with low privileges on a system running an affected kernel. An attacker triggers the vulnerable teardown path, typically through module unload, device removal, or driver reinitialization sequences that exercise the ACP genpd cleanup. Follow-on operations that walk gpd_list then dereference the freed memory.

A successful memory reuse before the dangling pointer is accessed can enable controlled kernel memory corruption, which may be escalated to code execution in kernel context.

The vulnerability mechanism is documented in the upstream fix commits. See the Linux Kernel Commit 08fee49 and Linux Kernel Commit cd8650d (cherry-pick source) for the source-level changes.

Detection Methods for CVE-2026-68104

Indicators of Compromise

Unexpected kernel oops or panic messages referencing pm_genpd, gpd_list, or amdgpu in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in generic power domain code paths on kernels with debug instrumentation
Repeated amdgpu driver unload and reload sequences from unprivileged user contexts

Detection Strategies

Inventory Linux hosts by kernel version and cross-reference against the fixed commits listed in the NVD references
Monitor kernel ring buffer output for BUG:, general protection fault, or KASAN entries correlated with graphics or power management subsystems
Track loading and unloading of the amdgpu module and related ACP components via audit rules

Monitoring Recommendations

Enable persistent kernel log collection and forward to a centralized log platform for retention and correlation
Alert on kernel crash artifacts, vmcore generation, and abnormal reboots on workstations and servers with AMD GPUs
Baseline expected amdgpu module lifecycle events and flag deviations that could indicate exploitation attempts

How to Mitigate CVE-2026-68104

Immediate Actions Required

Apply the stable kernel update that includes the upstream fix referenced by commits 08fee49, 28c9b3c, 5c0a822, 930a5dc, and bdfc7f1
Reboot affected hosts after patching to ensure the corrected amdgpu driver is loaded
Restrict local shell and console access on systems that cannot be immediately patched

Patch Information

The fix cherry-picks upstream commit cd8650d7a91ee8b768e202354672553faa5cc1f2 into the stable branches. It calls pm_genpd_remove() before releasing the acp_genpd allocation and clears the pointer after free. Distribution kernel updates that incorporate any of the listed stable commits resolve the flaw. Consult vendor security advisories from the relevant Linux distribution for packaged updates.

Workarounds

Blacklist the amdgpu module on systems that do not require AMD GPU functionality until a patched kernel is deployed
Limit local user accounts and remove shell access for untrusted users to reduce the attack surface for local privilege escalation
Disable ACP functionality where supported by firmware or module parameters if the audio coprocessor is not in use

bash

# Verify current kernel version and check for the fix
uname -r

# Example: blacklist amdgpu until a patched kernel is available
echo 'blacklist amdgpu' | sudo tee /etc/modprobe.d/blacklist-amdgpu.conf
sudo update-initramfs -u

# Apply distribution kernel updates (Debian/Ubuntu example)
sudo apt update && sudo apt upgrade linux-image-generic
sudo reboot