CVE-2026-80618: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
amdgpuamdkfdgpuvmfreememoryofgpu() unpinned DOORBELL and MMIO remap BOs (which are pinned at allocation time) before checking whether the BO is still mapped to the GPU. When the BO is still mapped, the function returns -EBUSY and leaves the BO alive, but it has already been unpinned. The BO is then unpinned again when it is finally freed during process teardown, triggering a ttmbounpin() underflow warning:
WARNING: CPU: 18 PID: 15066 at ttm/ttmbo.c:650 amdttmbounpin+0x6d/0x80 [amdttm] Workqueue: kfdprocesswq kfdprocesswqrelease [amdgpu] RIP: 0010:amdttmbounpin+0x6d/0x80 [amdttm] Call Trace: amdgpubounpin+0x1a/0x90 [amdgpu] amdgpuamdkfdgpuvmunpinbo+0x31/0xb0 [amdgpu] amdgpuamdkfdgpuvmfreememoryofgpu+0x3bf/0x460 [amdgpu] kfdprocessfreeoutstandingkfdbos+0xd4/0x170 [amdgpu] kfdprocesswqrelease+0x109/0x1b0 [amdgpu] processonework+0x1e2/0x3b0 workerthread+0x50/0x3a0 kthread+0xdd/0x100 retfromfork+0x29/0x50
Move the unpin after the mappedtogpumemory check so it only happens once we are committed to freeing the BO.
(cherry picked from commit 927c5b2defb9b09856444d94bebfd056a002bd75)
Event History
Frequently Asked Questions
Which systems are relevant to this issue?
The issue is in the Linux kernel's AMD KFD/amdgpu GPU-memory handling path. It involves DOORBELL and MMIO remap buffer objects managed by amdgpu_amdkfd_gpuvm_free_memory_of_gpu().
What condition triggers the double unpin?
The condition occurs when a DOORBELL or MMIO remap buffer object is being freed while it is still mapped to GPU memory. The free operation returns -EBUSY and leaves the object alive after already unpinning it, so process teardown can unpin it a second time.
How can an administrator recognize that this occurred?
The reported symptom is a ttm_bo_unpin() underflow warning from amdttm_bo_unpin. The call trace includes amdgpu_amdkfd_gpuvm_free_memory_of_gpu, kfd_process_free_outstanding_kfd_bos, and kfd_process_wq_release.