UBUNTU-CVE-2026-89813: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset(). Its hw fence value lives in wb (GTT) memory and survives a MODE1 reset while fencedrv.syncseq keeps advancing, so after a reset the first KIQ submission can poll forever on a seq that is never written back. Force complete the KIQ ring fences too so their hw fence is realigned to syncseq.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
During reset, force-complete the KIQ ring fences and realign their hardware fence value in WB (GTT) memory to fence_drv.sync_seq so the first post-reset KIQ submission cannot poll forever.
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
An attacker or local user needs the ability to cause an AMD GPU reset and then trigger a KIQ ring submission. The failure occurs after a MODE1 reset when the KIQ hardware fence value remains stale while the software synchronization sequence advances.
What is the operational impact if the issue is triggered?
The first KIQ submission after the affected reset can poll indefinitely for a fence sequence that will never be written back. This can result in a GPU-related hang or availability impact.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-azure-fips, ubuntu/linux-aws-fips, ubuntu/linux-fips, ubuntu/linux-gcp, ubuntu/linux-gcp-fips, and ubuntu/linux-oracle.