Security readout for executives and security teams
Plain-English summary
A race in the Linux AMDGPU recovery process can access a GPU job after it has been freed. This may crash the system or corrupt kernel memory. The supplied CVSS assessment also allows confidentiality and integrity impact, but the sources provide no demonstrated attack or exploitation evidence.
Executive priority
Prioritize remediation on multi-user systems and GPU compute environments using AMD hardware. Treat as high severity because kernel memory corruption can have broad impact, while recognizing that the supplied evidence does not establish real-world exploitation. Validate vendor backports promptly rather than relying only on kernel version strings.
Technical view
During GPU recovery, drm_sched_start() restarts the timeout queue, which may free a job before the timeout callback finishes reading job->pasid. This creates a slab use-after-free in amdgpu_device_gpu_recover. The fix caches the PASID before the competing operation can free the job.
Likely exposure
Exposure is limited to Linux systems using the AMDGPU driver and affected kernel revisions where GPU recovery and scheduler timeout activity can race. The supplied affected-version data identifies versions including 6.17 through 6.19 but is ambiguously encoded; confirm exact status with the kernel or distribution vendor.
Exploitation context
The supplied CVSS vector describes local, low-privilege exploitation with low complexity and no user interaction. However, the sources show only a KASAN-detected failure, provide no exploit demonstration, and state that the CVE is not in KEV. Active exploitation is therefore not established.
Researcher notes
The documented race is between the scheduler timeout callback and TDR work during stop-and-restart recovery. KASAN observed a four-byte read after free in amdgpu_device_gpu_recover. The fix caches job->pasid early. Exact vulnerable boundaries remain uncertain because the supplied version entries are irregular and should be reconciled against upstream commits.
Mitigation direction
- Update to a vendor kernel incorporating the referenced upstream stable fix.
- Check Linux distribution advisories for exact affected and fixed package versions.
- Prioritize GPU workloads where untrusted local users can access AMDGPU functionality.
- If patching is delayed, consult vendor guidance for supported exposure-reduction measures.
Validation and detection
- Inventory Linux kernel versions and systems loading the AMDGPU driver.
- Compare deployed kernel commits or packages with the referenced stable fixes.
- Confirm distribution backport status; version numbers alone may not prove vulnerability.
- Review kernel logs for AMDGPU recovery failures or use-after-free diagnostics after authorized testing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68793 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/dac58c012c47cadf337a35eb05d44498c43e5cd0CVE reference, Linux
- https://git.kernel.org/stable/c/77f73253015cbc7893fca1821ac3eae9eb4bc943CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.