CVE-2026-93176

What it actually does

The vulnerability is a use-after-free caused by a dangling pointer in amdgpu_dm_plane_drm_plane_reset: the old state is freed before kzalloc allocates a replacement, and on allocation failure the stale pointer is left pointing to freed memory.

Why it matters to the business

Local attackers on Linux systems using AMD GPUs could trigger kernel memory corruption leading to crashes, privilege escalation, or arbitrary code execution, with low public exploit activity reducing immediate widespread risk but still requiring prompt attention on affected hardware.

How an attack unfolds

An attacker with local user access invokes the plane-reset code path, forces kzalloc to fail after the old state has been freed, then reads or writes through the dangling pointer to corrupt kernel memory or leak data.

How to fix it

Apply the upstream kernel patch that allocates the new state before freeing the old state, or upgrade to a kernel release containing the corrected amdgpu_dm_plane_drm_plane_reset implementation.

How to confirm the fix worked

Inspect the source of amdgpu_dm_plane_drm_plane_reset to verify that allocation occurs before the free of the prior state, and confirm the fix is present in the running kernel via source or binary comparison.

Typical attack path

1. Obtain local shell or user context on the target Linux system
2. Trigger DRM plane reset operations that reach amdgpu_dm_plane_drm_plane_reset
3. Induce kzalloc failure after the free of the prior state
4. Access the dangling pointer to achieve memory corruption or information disclosure

How to detect it

Review kernel logs and dmesg for repeated failures or crashes inside amdgpu_dm_plane_drm_plane_reset, and watch for anomalous memory access or oops reports involving freed DRM plane state objects.

What your security team should do

• Prioritize kernel updates on systems with AMD GPUs despite low EPSS and no KEV listing
• Limit local unprivileged access on multi-user AMD GPU hosts until patched
• Include AMD DRM plane-reset paths in kernel crash and memory-corruption monitoring