CVE-2026-68364: Linux Kernel Race Condition Vulnerability

CVE-2026-68364 Overview

CVE-2026-68364 is a Linux kernel vulnerability in the AMD GPU DRM display driver. The flaw produces an ABBA deadlock in the Idle Stream Manager (ISM) suspend path. The amdgpu_dm_ism_disable() function is called while holding dc_lock and waits for delayed ISM work via disable_delayed_work_sync(). The work handlers themselves acquire dc_lock, causing a system hang during suspend/resume when a worker is in flight, typically when video playback is active at suspend time.

Critical Impact
A local attacker or unprivileged user triggering suspend during video playback can deadlock the kernel, resulting in a full system hang and denial of service on AMD GPU systems.

Affected Products

Linux kernel builds including the AMD GPU DRM display driver (drm/amd/display) with the ISM code path
Systems using AMD graphics with amdgpu kernel module and DC (Display Core) locking
Distributions shipping upstream kernels prior to the fix commits 3714fe242592 and 95776812e6b8

Discovery Timeline

2026-08-10 - CVE-2026-68364 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68364

Vulnerability Analysis

The vulnerability is a classic ABBA deadlock [CWE-833] in the AMD Display Core (DC) subsystem of the Linux kernel. The Idle Stream Manager (ISM) uses delayed work items to manage display power states. During suspend, the driver disables ISM to force the finite state machine back to FULL_POWER_RUNNING.

The original code path acquired dc_lock and then called disable_delayed_work_sync() to quiesce workers. However, those same worker functions attempted to acquire dc_lock themselves. If a worker was already executing when suspend fired, the suspend thread would wait forever for the worker to finish, while the worker would wait forever for dc_lock to be released.

The fix splits the disable path into two phases with opposite locking contracts. amdgpu_dm_ism_disable() now quiesces workers without holding dc_lock. A new function, amdgpu_dm_ism_force_full_power(), drives the ISM FSM back to FULL_POWER_RUNNING while holding dc_lock. This separation eliminates the circular wait condition.

Root Cause

The root cause is inconsistent lock ordering between the suspend path and ISM delayed work handlers. Both code paths required dc_lock, but the suspend path also required worker completion. This violated the standard rule that synchronous waits on external work must not occur while holding locks that the work itself needs.

Attack Vector

The deadlock triggers during normal system suspend when an ISM delayed worker is in flight. Video playback keeps display workers active, making the race window practical to hit. Exploitation requires local access and the ability to initiate a suspend cycle. The impact is limited to denial of service through system hang; no code execution or privilege escalation results. See the kernel commit 3714fe242592 and kernel commit 95776812e6b8 for the fix details.

Detection Methods for CVE-2026-68364

Indicators of Compromise

Kernel hung task warnings referencing amdgpu_dm_ism_disable or disable_delayed_work_sync in dmesg output
System unresponsive after issuing suspend while video is playing on AMD GPU hardware
lockdep warnings about circular locking dependency involving dc_lock if lock debugging is enabled

Detection Strategies

Enable CONFIG_LOCKDEP and CONFIG_PROVE_LOCKING on test systems to surface ABBA lock cycles before production deployment
Monitor /var/log/kern.log and journal entries for hung_task_timeout_secs warnings mentioning the amdgpu display stack
Correlate suspend-resume failures with active video sessions across managed endpoints running affected kernels

Monitoring Recommendations

Track kernel version inventory across the fleet and flag hosts running unpatched kernels on AMD GPU hardware
Alert on repeated forced reboots or unexpected power cycles that follow suspend attempts
Collect kernel crash dumps and hung task reports through centralized logging for post-incident analysis

How to Mitigate CVE-2026-68364

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 3714fe242592 and 95776812e6b8 or update to a distribution kernel that includes them
Identify all AMD GPU systems in the environment and prioritize patching for laptops and workstations that regularly suspend
Validate suspend/resume cycles after patching by testing with active video playback

Patch Information

The fix is available in the mainline Linux kernel through two commits: 3714fe242592e3699ac5e2c19d68b275a210be7d and 95776812e6b8f908563e8994d5d947b68baf68a6. Downstream distributions should backport these changes to their supported kernel branches.

Workarounds

Disable automatic suspend on affected AMD GPU systems until the patch is applied
Stop video playback and other display-intensive workloads before initiating suspend
Consider disabling the ISM power feature through kernel module parameters where supported by the driver version in use

bash

# Verify kernel version and check for the fix
uname -r
git log --oneline | grep -E '3714fe242592|95776812e6b8'

# Temporarily disable automatic suspend as a workaround
systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target