CVE-2026-89828: drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix init ordering in amdgpuvrammgrinit()
drmmcgroupregisterregion() is called before INITLISTHEAD() and gpubuddyinit() in amdgpuvrammgrinit(). If it fails, the function returns early and bypasses those initializations.
Since adev->mman.initialized is set to true before amdgpuvrammgrinit() is called, a failure triggers amdgputtmfini(), which calls amdgpuvrammgrfini(), which then:
- Calls listforeachentrysafe() on reservationspending and reservedpages, whose listhead::next pointers are zero-initialized (NULL). The loop does not recognize them as empty and dereferences NULL.
- Calls gpubuddyfini(), which iterates freetrees[] unconditionally via foreachfreetree(). Since mm->freetrees is NULL (never allocated), this dereferences NULL.
Both result in a kernel panic on the module load error path.
Fix by moving drmmcgroupregisterregion() to after the list and buddy allocator are fully initialized, so the teardown path is safe to run.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
Event History
Frequently Asked Questions
When can this lead to a kernel panic?
The panic occurs on the amdgpu module-load error path when drmm_cgroup_register_region() fails before the VRAM manager's lists and GPU buddy allocator have been initialized. Subsequent teardown through amdgpu_ttm_fini() then dereferences uninitialized list or allocator state.
What condition is required to trigger the affected error path?
drmm_cgroup_register_region() must fail during amdgpu_vram_mgr_init(). The provided information does not specify what environmental or configuration conditions cause that registration to fail.
How can I determine whether a system is already encountering this issue?
Look for a kernel panic during amdgpu module loading, particularly where teardown involves amdgpu_vram_mgr_fini(), list traversal of reservations_pending or reserved_pages, or gpu_buddy_fini() accessing free_trees. These failures occur after an earlier initialization failure in the VRAM manager.
What is the remediation?
Apply the kernel fix that moves drmm_cgroup_register_region() until after the VRAM manager's list heads and GPU buddy allocator have been initialized. This ensures the cleanup path can safely run if region registration fails.