CVE-2026-93809: drm/amdgpu: flush pending RCU callbacks on module unload

Published Sep 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: flush pending RCU callbacks on module unload

Call rcubarrier() in module exit to wait for outstanding callrcu() callbacks before freeing module text, preventing late callback execution in freed memory.

BUG: unable to handle page fault for address: ffffffffc1d59c40 PGD 6a12067 P4D 6a12067 PUD 6a14067 PMD 13698b067 PTE 0 Oops: 0010 [#1] SMP NOPTI RIP: 0010:0xffffffffc1d59c40 Code: Unable to access opcode bytes at RIP 0xffffffffc1d59c16. RSP: 0018:ffffc900198c0f28 EFLAGS: 00010286 RAX: ffffffffc1d59c40 RBX: ffff897c7d6b61c0 RCX: ffff88826aff4590 RDX: ffff8884d8b35490 RSI: ffffc900198c0f30 RDI: ffff88812af67290 RBP: 000000000000000a (DONE segment entries) R08: 0000000000000000 R09: 0000000000000100 R10: 0000000000000000 R11: ffffffff82a06100 R12: ffff88811a4e3700 R13: 0000000000000000 R14: ffff897c7d6b6270 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff897c7d680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc1d59c16 CR3: 00000104a980a001 CR4: 0000000002770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? rcudobatch+0x163/0x450 ? rcucore+0x177/0x1c0 ? dosoftirq+0xc1/0x280 ? asmcallirqonstack+0xf/0x20 </IRQ> ? dosoftirqownstack+0x37/0x50 ? irqexitrcu+0xc4/0x100 ? sysvecapictimerinterrupt+0x36/0x80 ? asmsysvecapictimerinterrupt+0x12/0x20 ? cpuidleenterstate+0xd4/0x360 ? cpuidleenter+0x29/0x40 ? cpuidleidlecall+0x108/0x1a0 ? doidle+0x77/0xf0 ? cpustartupentry+0x19/0x20 ? secondarystartup64noverify+0xbf/0xcb

(cherry picked from commit feaa5039f6c12acc9aa934c2d45dcd251a12c69f)

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade drm/amdgpu to a version that resolves this vulnerability.

    Patch feaa5039f6c12acc9aa934c2d45dcd251a12c69f

Event History

Sep 24, 2026
CVE Published
via MITRE·04:02 PM
Data Sourced
via MITRE·04:02 PM
Description
Data Sourced
via NVD·05:17 PM
Description

Frequently Asked Questions

1

When can this issue occur?

It can occur when the amdgpu kernel module is unloaded while RCU callbacks previously queued by the module are still pending. A callback may then execute after the module's text has been freed.

2

What is the likely impact on an affected system?

The reported failure is a kernel page fault caused by execution at an address in freed module memory. This can result in a kernel oops during or after amdgpu module unload.

3

Is a system affected if the amdgpu module is never unloaded?

The described condition specifically involves module unload with outstanding call_rcu() callbacks. The provided information does not identify an issue during normal operation when the module remains loaded.

4

What mitigation is available if an update cannot be applied immediately?

Avoid unloading the amdgpu module while it may have pending RCU callbacks. The fix adds rcu_barrier() during module exit so unload waits for outstanding callbacks before module text is freed.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203