CVE-2026-93809: drm/amdgpu: flush pending RCU callbacks on module unload
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: flush pending RCU callbacks on module unload
Call rcubarrier() in module exit to wait for outstanding callrcu() callbacks before freeing module text, preventing late callback execution in freed memory.
BUG: unable to handle page fault for address: ffffffffc1d59c40 PGD 6a12067 P4D 6a12067 PUD 6a14067 PMD 13698b067 PTE 0 Oops: 0010 [#1] SMP NOPTI RIP: 0010:0xffffffffc1d59c40 Code: Unable to access opcode bytes at RIP 0xffffffffc1d59c16. RSP: 0018:ffffc900198c0f28 EFLAGS: 00010286 RAX: ffffffffc1d59c40 RBX: ffff897c7d6b61c0 RCX: ffff88826aff4590 RDX: ffff8884d8b35490 RSI: ffffc900198c0f30 RDI: ffff88812af67290 RBP: 000000000000000a (DONE segment entries) R08: 0000000000000000 R09: 0000000000000100 R10: 0000000000000000 R11: ffffffff82a06100 R12: ffff88811a4e3700 R13: 0000000000000000 R14: ffff897c7d6b6270 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff897c7d680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc1d59c16 CR3: 00000104a980a001 CR4: 0000000002770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? rcudobatch+0x163/0x450 ? rcucore+0x177/0x1c0 ? dosoftirq+0xc1/0x280 ? asmcallirqonstack+0xf/0x20 </IRQ> ? dosoftirqownstack+0x37/0x50 ? irqexitrcu+0xc4/0x100 ? sysvecapictimerinterrupt+0x36/0x80 ? asmsysvecapictimerinterrupt+0x12/0x20 ? cpuidleenterstate+0xd4/0x360 ? cpuidleenter+0x29/0x40 ? cpuidleidlecall+0x108/0x1a0 ? doidle+0x77/0xf0 ? cpustartupentry+0x19/0x20 ? secondarystartup64noverify+0xbf/0xcb
(cherry picked from commit feaa5039f6c12acc9aa934c2d45dcd251a12c69f)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drm/amdgputo a version that resolves this vulnerability.Patch feaa5039f6c12acc9aa934c2d45dcd251a12c69f
Event History
Frequently Asked Questions
When can this issue occur?
It can occur when the amdgpu kernel module is unloaded while RCU callbacks previously queued by the module are still pending. A callback may then execute after the module's text has been freed.
What is the likely impact on an affected system?
The reported failure is a kernel page fault caused by execution at an address in freed module memory. This can result in a kernel oops during or after amdgpu module unload.
Is a system affected if the amdgpu module is never unloaded?
The described condition specifically involves module unload with outstanding call_rcu() callbacks. The provided information does not identify an issue during normal operation when the module remains loaded.
What mitigation is available if an update cannot be applied immediately?
Avoid unloading the amdgpu module while it may have pending RCU callbacks. The fix adds rcu_barrier() during module exit so unload waits for outstanding callbacks before module text is freed.