CVE-2026-93139: drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC
The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed by XCC ID >= 2. Extend the loop to cover all XCCs (AMDGPUMAXMESPIPES numxcc), matching other per-XCC arrays.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the null pointer dereference?
Systems using the AMDGPU MES driver on multi-XCC GPUs are affected when the driver accesses per-XCC array entries beyond the initially covered MES pipe count. The problematic accesses occur for XCC IDs of 2 or greater.
What condition triggers the failure?
The failure occurs when code accesses hung_queue_db_array entries indexed by an XCC ID that was not initialized because the loop covered only AMDGPU_MAX_MES_PIPES entries rather than AMDGPU_MAX_MES_PIPES multiplied by num_xcc.