CVE-2026-89808: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram

When migration vm range is hole at cpu side(MIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svmmigratecopymemorygart() will return an uninitialized r. That can trigger outfreevrampages to drop all VRAM just set up.

Initialize r and only call the last svmmigratecopymemorygart if j > 0.

Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drmbuddyblock; avoids another svmmigratecopymemorygart.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 16, 2026
CVE Published
via MITRE·10:30 AM
Data Sourced
via MITRE·10:30 AM
Description

Frequently Asked Questions

1

Who is exposed to this issue?

Systems using the Linux kernel's AMD KFD driver and performing SVM migration from CPU memory to VRAM can encounter this condition. The affected path specifically involves a CPU-side migration range that contains a hole.

2

What condition triggers the failure?

The condition occurs when a migration page-frame entry has MIGRATE_PFN_MIGRATE set but MIGRATE_PFN_VALID unset. In that case, the driver can allocate device pages despite having no source-page DMA mapping or migration work to perform.

3

What is the effect of hitting the vulnerable path?

The final copy routine can return an uninitialized value when no pages were processed, causing cleanup to drop VRAM pages that were just set up. The fix initializes the result and skips the final copy call when no pages were processed.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203