CVE-2025-68793

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix a job->pasid access race in gpu recovery

Avoid a possible UAF in GPU recovery due to a race between

the sched timeout callback and the tdr work queue.

The gpu recovery function calls drm_sched_stop() and

later drm_sched_start(). drm_sched_start() restarts

the tdr queue which will eventually free the job. If

the tdr queue frees the job before time out callback

completes, the job will be freed and we'll get a UAF

when accessing the pasid. Cache it early to avoid the

UAF.

Example KASAN trace:

[ 493.058141] BUG: KASAN: slab-use-after-free in amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]

[ 493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323

[ 493.074892]

[ 493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G E 6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary)

[ 493.076493] Tainted: [E]=UNSIGNED_MODULE

[ 493.076

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References