CVE-2026-89814: drm/amdgpu: clamp the isolation index for rings outside a partition

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: clamp the isolation index for rings outside a partition

adev->isolation[] has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is ~0, so indexing the array with it is out of bounds. SDMA submissions hit this on both the isolation enforcement and the VM flush path and trip UBSAN.

Fall back to the first slot the way the cleaner shader path already does, and stop taking the address before the ring type check that makes it relevant.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 16, 2026
CVE Published
via MITRE·10:30 AM
Data Sourced
via MITRE·10:30 AM
Description

Frequently Asked Questions

1

What systems are exposed to this issue?

Systems using the Linux kernel amdgpu driver are exposed when they have rings that are not assigned to a partition. The described failing paths are SDMA submission isolation enforcement and VM flush handling.

2

What condition triggers the out-of-bounds access?

A ring outside a partition retains the AMDGPU_XCP_NO_PARTITION isolation index, which is approximately zero inverted. Using that value to index adev->isolation[] accesses the array out of bounds.

3

How can affected behavior be detected?

The issue can trip UBSAN during SDMA submissions, including in the isolation enforcement or VM flush paths. UBSAN reports associated with an out-of-bounds adev->isolation[] access are an indicator.

4

What is the mitigation if an update cannot be applied immediately?

The provided information does not specify an operational workaround. The resolved behavior clamps the isolation index for rings outside a partition to the first isolation slot and avoids taking the isolation-array address before the relevant ring-type check.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203