CVE-2026-89808: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram
When migration vm range is hole at cpu side(MIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svmmigratecopymemorygart() will return an uninitialized r. That can trigger outfreevrampages to drop all VRAM just set up.
Initialize r and only call the last svmmigratecopymemorygart if j > 0.
Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drmbuddyblock; avoids another svmmigratecopymemorygart.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel's AMD KFD driver and performing SVM migration from CPU memory to VRAM can encounter this condition. The affected path specifically involves a CPU-side migration range that contains a hole.
What condition triggers the failure?
The condition occurs when a migration page-frame entry has MIGRATE_PFN_MIGRATE set but MIGRATE_PFN_VALID unset. In that case, the driver can allocate device pages despite having no source-page DMA mapping or migration work to perform.
What is the effect of hitting the vulnerable path?
The final copy routine can return an uninitialized value when no pages were processed, causing cleanup to drop VRAM pages that were just set up. The fix initializes the result and skips the final copy call when no pages were processed.