CVE-2026-89827: drm/amdgpu: avoid force-completing uninitialized UVD rings
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: avoid force-completing uninitialized UVD rings
uvdv70swinit() does not initialize the UVD decode ring for an SR-IOV VF. However, amdgpuuvdresume() unconditionally force-completes the decode ring when restoring its fence sequence.
Skip fence completion when the fence driver is not initialized.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected path is specific to AMDGPU UVD version 7.0 running as an SR-IOV virtual function. The problem occurs because the UVD decode ring is not initialized for that VF configuration.
When is the vulnerable code path reached?
The issue is triggered when amdgpu_uvd_resume() restores the fence sequence and attempts to force-complete the UVD decode ring. In the affected SR-IOV VF case, that ring's fence driver has not been initialized.
What does the fix change?
The fix skips fence completion when the fence driver is not initialized, preventing force-completion of the uninitialized UVD decode ring.