CVE-2026-89810
HighCVSS 7.8Summary
In the Linux kernel, the drm/amdkfd driver had an error-path bug in svm_migrate_copy_to_ram. When page migration from device to system RAM fails, the driver used a DMA address instead of the page physical address (pfn) to release and unlock allocated system pages, which is incorrect with IOMMU enabled. The fix releases pages based on struct page* and performs dma_unmap on the corresponding system RAM pages.
Risk Assessment
Incorrect page release on migration failure can cause memory leaks or corruption of DMA/IOMMU mapping state, potentially leading to system instability. Affects systems with AMD GPUs and IOMMU enabled.
Recommendation
Update the Linux kernel to a version containing this fix (drm/amdkfd commit). If update is not possible, restrict GPU device access for untrusted users.
Other vulnerabilities in Linux kernel (drm/amdkfd)
See all- CVE-2026-89808High
In the Linux kernel, the drm/amdkfd driver had a bug when the migration VM range is a hole on the CPU side (MIGRATE_PFN_MIGRATE set, MIGRATE_PFN_VALID unset). The driver still allocated device pages, and an uninitialized variable r could trigger out_free_vram_pages to drop all just-set-up VRAM. The fix initializes r and only calls the final svm_migrate_copy_memory_gart if j > 0.
- CVE-2026-89807Unknown
In the Linux kernel, the drm/amdkfd driver lacked a NULL guard for restore_mqd during CRIU queue restore. A user with CAP_CHECKPOINT_RESTORE could trigger a kernel NULL pointer dereference and panic by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. The fix adds a NULL guard and returns -EOPNOTSUPP if the callback is not implemented.
- CVE-2026-45878High
A vulnerability has been identified in the Linux kernel related to improper bounds checking of watch_id in address debugging. Passing a large watch_id from userspace can lead to buffer overflow errors and invalid memory access.
- CVE-2024-49991High
A vulnerability has been identified and resolved in the Linux kernel within the drm/amdkfd module. The issue was related to improper pointer clearing, which could lead to a use-after-free bug.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn, then get struct page*. Current driver uses dma address(for adev) that is not correct with IOMMU enabled, or even in general. The patch releases and unlocks allocated system pages based on where migration failed by struct page* of sys ram pages. Also dma_unmap correspodent system ram pages at error path.