UBUNTU-CVE-2026-89828: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: When can this cause a system crash?

The panic occurs on the AMDGPU module-load error path when drmm_cgroup_register_region() fails before the VRAM manager's list heads and buddy allocator have been initialized. Cleanup then dereferences uninitialized or NULL structures.

Q: What hardware or deployments are most relevant?

Systems using the AMDGPU driver are relevant, because the affected initialization and teardown paths are in amdgpu_vram_mgr_init() and amdgpu_vram_mgr_fini(). The provided data does not identify a specific GPU model or configuration requirement beyond use of AMDGPU.

Q: Is this an issue during normal GPU operation?

The described failure is limited to module initialization failure and its subsequent teardown path. The data describes a kernel panic during module load error handling, not a failure during successful normal operation.

Q: How can I tell whether a crash matches this issue?

A matching event would be a kernel panic while loading AMDGPU after an initialization failure, with teardown involving amdgpu_vram_mgr_fini(), list traversal of reservations_pending or reserved_pages, or gpu_buddy_fini() accessing free_trees. The provided data does not include a specific log signature.

Published Sep 16, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit() drmmcgroupregisterregion() is called before INITLISTHEAD() and gpubuddyinit() in amdgpuvrammgrinit(). If it fails, the function returns early and bypasses those initializations. Since adev->mman.initialized is set to true before amdgpuvrammgrinit() is called, a failure triggers amdgputtmfini(), which calls amdgpuvrammgrfini(), which then: - Calls listforeachentrysafe() on reservationspending and reservedpages, whose listhead::next pointers are zero-initialized (NULL). The loop does not recognize them as empty and dereferences NULL. - Calls gpubuddyfini(), which iterates freetrees[] unconditionally via foreachfreetree(). Since mm->freetrees is NULL (never allocated), this dereferences NULL. Both result in a kernel panic on the module load error path. Fix by moving drmmcgroupregisterregion() to after the list and buddy allocator are fully initialized, so the teardown path is safe to run.

Affected Software

128 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0*

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-42.42~24.04.1

7.0.0-42.42~24.04.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-42.42.1~24.04.1

7.0.0-42.42.1~24.04.1

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux<7.0.0-42.42

7.0.0-42.42

ubuntu/linux-aws<7.0.0-1016.17

7.0.0-1016.17

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<7.0.0-1016.18

7.0.0-1016.18

ubuntu/linux-gke*

ubuntu/linux-ibm<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos*

ubuntu/linux-oem-7.0<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-oracle<7.0.0-1015.16

7.0.0-1015.16

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv<7.0.0-42.42.1

7.0.0-42.42.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.17
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.18
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.16
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1

Event History

Sep 16, 2026

CVE Published

via OSV·11:16 AM

Data Sourced

via OSV·11:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

When can this cause a system crash?

The panic occurs on the AMDGPU module-load error path when drmm_cgroup_register_region() fails before the VRAM manager's list heads and buddy allocator have been initialized. Cleanup then dereferences uninitialized or NULL structures.

What hardware or deployments are most relevant?

Systems using the AMDGPU driver are relevant, because the affected initialization and teardown paths are in amdgpu_vram_mgr_init() and amdgpu_vram_mgr_fini(). The provided data does not identify a specific GPU model or configuration requirement beyond use of AMDGPU.

Is this an issue during normal GPU operation?

The described failure is limited to module initialization failure and its subsequent teardown path. The data describes a kernel panic during module load error handling, not a failure during successful normal operation.

How can I tell whether a crash matches this issue?

A matching event would be a kernel panic while loading AMDGPU after an initialization failure, with teardown involving amdgpu_vram_mgr_fini(), list traversal of reservations_pending or reserved_pages, or gpu_buddy_fini() accessing free_trees. The provided data does not include a specific log signature.

UBUNTU-CVE-2026-89828: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

When can this cause a system crash?

What hardware or deployments are most relevant?

Is this an issue during normal GPU operation?

How can I tell whether a crash matches this issue?

Company

Resources

Contact

Frequently Asked Questions

When can this cause a system crash?

What hardware or deployments are most relevant?

Is this an issue during normal GPU operation?

How can I tell whether a crash matches this issue?