CVE-2026-89810: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix error path at svmmigratecopytoram
If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn, then get struct page. Current driver uses dma address(for adev) that is not correct with IOMMU enabled, or even in general.
The patch releases and unlocks allocated system pages based on where migration failed by struct page of sys ram pages. Also dmaunmap correspodent system ram pages at error path.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the svm_migrate_copy_to_ram error path, when page migration device->system RAM fails, release and unlock allocated system pages by using the correct struct page* for the system RAM pages (derive struct page* from physical address or pfn), rather than an incorrect page address.
Linux DRM amdkfd driver (svm_migrate_copy_to_ram error path) use of struct page* for system RAM pages = Correct: derive struct page* for sys ram pages from physical address (or pfn) at error path instead of using incorrect page address(for adev)
Event History
Frequently Asked Questions
Which systems are most likely affected?
Systems using the Linux kernel AMD KFD driver and performing shared virtual memory page migration from an AMD device to system RAM are the relevant scope. The issue is especially significant when an IOMMU is enabled, because the erroneous cleanup uses a DMA address where a physical page address or PFN is required.
When can the faulty path be triggered?
It occurs when migration of pages from device memory to system RAM fails. The affected code then follows an error path that must release and unlock the allocated system pages and unmap the corresponding DMA mappings.
What is the practical impact of the fix?
The fix cleans up only the system RAM pages associated with the failed migration, using their struct page references rather than an AMD-device DMA address. It also performs the corresponding DMA unmapping on the error path.