CVE-2025-68230
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, the drm/amdgpu driver can cause a GPU page fault after hibernation and resume in a PF passthrough environment. The partition mode is not restored on resume, leading to incorrect registers and wrong stride size when accessing the MQD BO, causing out-of-bounds access. The fix ensures gfx_v9_4_3_switch_compute_partition() is called on resume from hibernation.
Risk Assessment
This can cause GPU page faults and system instability after resume from hibernation in PF passthrough environments, leading to denial of service.
Recommendation
Update the Linux kernel to a version containing the drm/amdgpu driver fix.
Other vulnerabilities in Linux kernel (drm/amdgpu)
See all- CVE-2026-89828Unknown
In the Linux kernel, amdgpu_vram_mgr_init() in the drm/amdgpu driver calls drmm_cgroup_register_region() before initializing lists and the buddy allocator. On failure, an early return bypasses those initializations, and the teardown path then dereferences NULL pointers, causing a kernel panic on the module load error path.
- CVE-2026-89827Low risk· EPSS 10%
In the Linux kernel, uvd_v7_0_sw_init() does not initialize the UVD decode ring for an SR-IOV VF, yet amdgpu_uvd_resume() unconditionally force-completes that ring when restoring its fence sequence. This operates on an uninitialized ring.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix gpu page fault after hibernation on PF passthrough On PF passthrough environment, after hibernate and then resume, coralgemm will cause gpu page fault. Mode1 reset happens during hibernate, but partition mode is not restored on resume, register mmCP_HYP_XCP_CTL and mmCP_PSP_XCP_CTL is not right after resume. When CP access the MQD BO, wrong stride size is used, this will cause out of bound access on the MQD BO, resulting page fault. The fix is to ensure gfx_v9_4_3_switch_compute_partition() is called when resume from a hibernation. KFD resume is called separately during a reset recovery or resume from suspend sequence. Hence it's not required to be called as part of partition switch. (cherry picked from commit 5d1b32cfe4a676fe552416cb5ae847b215463a1a)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS