CVE-2025-68793: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68793 is a use-after-free (UAF) vulnerability in the Linux kernel's drm/amdgpu driver, specifically in the GPU recovery path. The flaw arises from a race condition between the scheduler timeout callback and the TDR (Timeout Detection and Recovery) work queue, where a job's pasid field may be accessed after the job has been freed. It was published on January 13, 2026, and affects the Linux kernel (vendor: linux, product: kernel). Feedly estimates its severity as Medium, with an EPSS score of 0.000180 (CVE Record, VulDB).

The root cause is a use-after-free condition (CWE-416) in the amdgpu_device_gpu_recover() function within the Linux kernel's AMDGPU DRM driver. During GPU recovery, drm_sched_stop() is called followed by drm_sched_start(), which restarts the TDR work queue. If the TDR queue frees the scheduler job before the timeout callback completes, a subsequent read of job->pasid accesses freed memory. The fix involves caching the pasid value early — before the job can be freed — to eliminate the race window. A KASAN trace confirming the bug shows a slab-use-after-free read of 4 bytes at the job structure address, triggered from the amdgpu-reset-dev workqueue (CVE Record).

Successful exploitation of this vulnerability could cause kernel memory corruption or a system crash (denial of service) due to the use-after-free condition. In more severe scenarios, a local attacker with access to GPU workloads could potentially leverage the memory corruption for privilege escalation, though this is not confirmed. The vulnerability is confined to systems running the AMDGPU driver and is most likely to manifest under GPU reset/recovery scenarios (CVE Record).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-68793. The EPSS score is very low at 0.000180, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access and the ability to trigger GPU recovery scenarios, significantly limiting the attack surface (CVE Record).

The vulnerability has been patched in the Linux kernel via upstream commits (e.g., 77f73253015c and dac58c012c47 on the stable branch). Ubuntu has issued multiple security notices addressing this CVE, including USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1. Users should update their Linux kernel packages to the versions provided by their distribution vendor as soon as possible (Ubuntu USN-8177-1, Ubuntu USN-8183-1, Ubuntu USN-8245-1, Ubuntu USN-8257-1).