CVE-2026-98389: drm/amdgpu: skip gfx switch_power_profile during GPU reset
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: skip gfx switchpowerprofile during GPU reset
During resume from GPU reset, the gfx idle work may invoke switchpowerprofile before the reset completes. This causes the following assert error because the register access occurs without first releasing the GPU reset semaphore:
[ 1576.768935] CR2: 0000559ea133ead0 CR3: 00000002e6c42000 CR4: 0000000000350ef0 [ 1576.768940] Call Trace: [ 1576.768944] <TASK> [ 1576.768953] amdgpudevicerreg+0x21/0x50 [amdgpu] [ 1576.769158] smumsgv1sendmsg+0x1a4/0x6e0 [amdgpu] [ 1576.769437] smucmnsendsmcmsgwithparamsext+0xba/0x120 [amdgpu] [ 1576.769721] smucmnsendsmcmsgwithparam+0x33/0x40 [amdgpu] [ 1576.769993] smuv1300setpowerprofilemode+0x192/0x2b0 [amdgpu] [ 1576.770267] smubumppowerprofilemode+0x5d/0x80 [amdgpu] [ 1576.770538] smuswitchpowerprofile+0xa4/0xf0 [amdgpu] [ 1576.770839] amdgpudpmswitchpowerprofile+0x6f/0x90 [amdgpu] [ 1576.771210] amdgpugfxprofileidleworkhandler+0xe9/0x130 [amdgpu] [ 1576.771460] processonework+0x23e/0x6f0 [ 1576.771491] workerthread+0x1c4/0x380 [ 1576.771506] kthread+0x10c/0x150 [ 1576.771512] ? pfxworkerthread+0x10/0x10 [ 1576.771518] ? pfxkthread+0x10/0x10 [ 1576.771530] retfromfork+0x314/0x390 [ 1576.771537] ? pfxkthread+0x10/0x10 [ 1576.771546] retfromforkasm+0x1a/0x30
(cherry picked from commit d93b1ff538ce9750c01e0dd0aa62575579c0fc08)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch d93b1ff538ce9750c01e0dd0aa62575579c0fc08
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel amdgpu driver are implicated. The failure occurs when the GPU resumes from a GPU reset and gfx idle work attempts to switch the power profile before reset completion.
What operational symptoms can indicate that a system is affected?
A kernel assert error may occur during GPU-reset recovery. The supplied call trace includes amdgpu_device_rreg, SMU power-profile functions, amdgpu_gfx_profile_idle_work_handler, and worker-thread execution.
Is exploitation dependent on a particular external attacker action?
The available information describes a race during resume from GPU reset, not an externally triggered attack path. It does not identify required attacker privileges, inputs, or a remote exploitation scenario.
What does the fix change?
The fix skips gfx switch_power_profile activity during GPU reset, preventing register access by the gfx idle work before the GPU reset semaphore has been released.