CVE-2026-89813: drm/amdgpu: force complete the KIQ ring fences on reset
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: force complete the KIQ ring fences on reset
Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset(). Its hw fence value lives in wb (GTT) memory and survives a MODE1 reset while fencedrv.syncseq keeps advancing, so after a reset the first KIQ submission can poll forever on a seq that is never written back.
Force complete the KIQ ring fences too so their hw fence is realigned to syncseq.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel AMDGPU driver are affected when the KIQ ring is used and the GPU undergoes a MODE1 reset. The failure can occur on the first KIQ submission after that reset.
What is the observable impact after a reset?
The first KIQ submission can poll indefinitely for a fence sequence value that is never written back. This can leave the KIQ operation stalled after the reset.
How can I determine whether this condition is present?
Investigate AMDGPU systems that experienced a MODE1 reset and subsequently show a KIQ submission polling indefinitely or failing to complete. The relevant condition is a mismatch between the KIQ hardware fence value retained in writeback memory and the advancing fence synchronization sequence.