CVE-2026-89808
HighCVSS 7.8Summary
In the Linux kernel, the drm/amdkfd driver had a bug when the migration VM range is a hole on the CPU side (MIGRATE_PFN_MIGRATE set, MIGRATE_PFN_VALID unset). The driver still allocated device pages, and an uninitialized variable r could trigger out_free_vram_pages to drop all just-set-up VRAM. The fix initializes r and only calls the final svm_migrate_copy_memory_gart if j > 0.
Risk Assessment
The bug can cause incorrect freeing of VRAM and system instability, including potential crashes or GPU data corruption. Affects systems with AMD GPUs using KFD.
Recommendation
Update the Linux kernel to a version with the drm/amdkfd fix. Monitor kernel logs for GPU memory migration errors.
Other vulnerabilities in Linux kernel (drm/amdkfd)
See all- CVE-2026-89810High
In the Linux kernel, the drm/amdkfd driver had an error-path bug in svm_migrate_copy_to_ram. When page migration from device to system RAM fails, the driver used a DMA address instead of the page physical address (pfn) to release and unlock allocated system pages, which is incorrect with IOMMU enabled. The fix releases pages based on struct page* and performs dma_unmap on the corresponding system RAM pages.
- CVE-2026-89807Unknown
In the Linux kernel, the drm/amdkfd driver lacked a NULL guard for restore_mqd during CRIU queue restore. A user with CAP_CHECKPOINT_RESTORE could trigger a kernel NULL pointer dereference and panic by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. The fix adds a NULL guard and returns -EOPNOTSUPP if the callback is not implemented.
- CVE-2026-45878High
A vulnerability has been identified in the Linux kernel related to improper bounds checking of watch_id in address debugging. Passing a large watch_id from userspace can lead to buffer overflow errors and invalid memory access.
- CVE-2024-49991High
A vulnerability has been identified and resolved in the Linux kernel within the drm/amdkfd module. The issue was related to improper pointer clearing, which could lead to a use-after-free bug.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set + MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart() will return an uninitialized r. That can trigger out_free_vram_pages to drop all VRAM just set up. Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0. Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drm_buddy_block; avoids another svm_migrate_copy_memory_gart.