CVE-2026-89814: drm/amdgpu: clamp the isolation index for rings outside a partition
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: clamp the isolation index for rings outside a partition
adev->isolation[] has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is ~0, so indexing the array with it is out of bounds. SDMA submissions hit this on both the isolation enforcement and the VM flush path and trip UBSAN.
Fall back to the first slot the way the cleaner shader path already does, and stop taking the address before the ring type check that makes it relevant.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel amdgpu driver are exposed when they have rings that are not assigned to a partition. The described failing paths are SDMA submission isolation enforcement and VM flush handling.
What condition triggers the out-of-bounds access?
A ring outside a partition retains the AMDGPU_XCP_NO_PARTITION isolation index, which is approximately zero inverted. Using that value to index adev->isolation[] accesses the array out of bounds.
How can affected behavior be detected?
The issue can trip UBSAN during SDMA submissions, including in the isolation enforcement or VM flush paths. UBSAN reports associated with an out-of-bounds adev->isolation[] access are an indicator.
What is the mitigation if an update cannot be applied immediately?
The provided information does not specify an operational workaround. The resolved behavior clamps the isolation index for rings outside a partition to the first isolation slot and avoids taking the isolation-array address before the relevant ring-type check.